joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x68696e6f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x437e62
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x4286352]
lea esi, [eax + 0x52]
xor esi, edx
and edx, ecx
and esi, ecx
add eax, ecx
add eax, 0x4286352
lea ecx, [esi + edx*2]
sub eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0xc2
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x437e20
mov ebx, dword [esp + 0x10]
mov eax, dword [0x4489d0]
test eax, eax
je 0x437eb6
xor ecx, ecx
mov edx, dword [0x4489d4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xe4aa2089
je 0x437e90
inc ecx
cmp eax, ecx
jne 0x437e80
jmp 0x437eb6
mov eax, dword [edx + ecx*8 + 4]
cmp eax, ebx
je 0x437eb6
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0x4489d8]
push eax
call fcn.004398f0
add esp, 0x1c
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x438008
mov dword [esp + 0x20], edi
push dword [esp + 8]
call fcn.00437c50
add esp, 4
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], 0x68696e6f
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x437f44
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x10]
lea esi, [ecx + 0x4286352]
lea edi, [ecx + 0x52]
xor edi, esi
and esi, edx
and edi, edx
add ecx, edx
add ecx, 0x4286352
lea edx, [edi + esi*2]
sub ecx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
add cl, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 0x10], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x437f00
mov ebx, dword [esp + 0x10]
mov ecx, dword [0x4489d0]
test ecx, ecx
je 0x437f94
xor edx, edx
mov esi, dword [0x4489d4]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe4aa2089
je 0x437f70
inc edx
cmp ecx, edx
jne 0x437f60
jmp 0x437f94
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, ebx
je 0x437f94
push 0
push eax
push dword [esp + 0xc]
push 5
push 4
push dword [0x4489d8]
push ecx
call fcn.004398f0
add esp, 0x1c
mov ebx, eax
test ebx, ebx
js 0x437ffc
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 4]
mov esi, dword [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebx]
movzx edi, word [eax + ebx]
test si, si
je 0x437fd5
add ebx, 2
cmp si, di
je 0x437fc0
cmp si, di
je 0x437fe7
mov esi, dword [ecx]
test esi, esi
jne 0x437fb0
mov ebx, 0xc0000225
jmp 0x437ffc
mov eax, dword [ecx + 0x44]
mov edx, dword [esp + 0x20]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0xdc]
mov dword [edx + 8], eax
xor ebx, ebx
push dword [esp + 4]
call fcn.00437d10
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x438040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0x438140
xor eax, eax
cmp dword [ecx], 0
jne 0x438145
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x438112
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + 0x4286352]
lea edi, [eax + 0x52]
xor edi, esi
and esi, edx
and edi, edx
add eax, edx
add eax, 0x4286352
lea edx, [edi + esi*2]
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x4380d0
mov eax, dword [esp + 8]
mov esi, dword [0x4489d0]
test esi, esi
je 0x438145
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x4489d4]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0x43814f
inc edi
cmp esi, edi
jne 0x438130
jmp 0x438145
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438145
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0x4489d8]
push esi
call fcn.004398f0
add esp, 0x1c
jmp 0x438145

Function at 0x438180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0x438257
mov esi, ecx
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x438204
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x4286352]
lea ebx, [ecx + 0x52]
xor ebx, edi
and edi, edx
and ebx, edx
add ecx, edx
add ecx, 0x4286352
lea edx, [ebx + edi*2]
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x4381c0
mov ecx, dword [0x4489d0]
test ecx, ecx
je 0x43824a
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0x4489d4]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0x438230
inc edi
cmp ecx, edi
jne 0x438220
jmp 0x43824a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x43824a
push eax
push 1
push dword [0x4489d8]
push ecx
call fcn.004398f0
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x438260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0x43844e
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0x43844e
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 8
ja 0x4382f4
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x4286352]
lea ebx, [ecx + 0x52]
xor ebx, edi
and edi, edx
and ebx, edx
add ecx, edx
add ecx, 0x4286352
lea edx, [ebx + edi*2]
sub ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 9
jb 0x4382b0
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0x4489d0]
test edx, edx
je 0x438345
xor ecx, ecx
mov ebx, dword [0x4489d4]
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0x438323
inc ecx
cmp edx, ecx
jne 0x438310
mov ebx, dword [ebp + 0x10]
jmp 0x438345
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0x438345
push dword [ebp + 8]
push eax
push 2
push dword [0x4489d8]
push ecx
call fcn.004398f0
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0x438443
cmp edi, 0xc000010a
jne 0x438443
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 8
ja 0x4383f7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x4286352]
lea ebx, [ecx + 0x52]
xor ebx, edi
and edi, edx
and ebx, edx
add ecx, edx
add ecx, 0x4286352
lea edx, [ebx + edi*2]
sub ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0xc2
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 9
jb 0x4383b0
mov edi, dword [esp + 8]
mov ecx, dword [0x4489d0]
test ecx, ecx
je 0x438443
xor edx, edx
mov ebx, dword [0x4489d4]
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0x438420
inc edx
cmp ecx, edx
jne 0x438410
jmp 0x438443
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0x438443
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0x4489d8]
push ecx
call fcn.004398f0
add esp, 0x18
mov edi, eax
test edi, edi
js 0x43844e
mov ecx, esi
call fcn.00438180
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x438460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x438477
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x68696e6f
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x4384e2
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
lea edi, [eax + 0x4286352]
lea ebx, [eax + 0x52]
xor ebx, edi
and edi, esi
and ebx, esi
add eax, esi
add eax, 0x4286352
lea esi, [ebx + edi*2]
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xc2
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x4384a0
mov eax, dword [esp + 8]
mov esi, dword [0x4489d0]
test esi, esi
je 0x438534
xor edi, edi
mov ebx, dword [0x4489d4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0x438510
inc edi
cmp esi, edi
jne 0x438500
jmp 0x438534
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x438534
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0x4489d8]
push esi
call fcn.004398f0
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x439920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x278
push dword [0x4509e8]
call fcn.0043a4d0
add esp, 4
movzx eax, al
jmp dword [eax*4 + 0x446af4]
Function at 0x43b180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov ecx, dword [ebp + 8]
mov dword [esp + 8], 0x636261b0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x13], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xe
ja 0x43b213
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea esi, [eax + edx]
add esi, 0x5007be90
add eax, 0x90
and eax, edx
add eax, eax
mov edx, eax
xor edx, esi
not eax
and eax, esi
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x10
mov edx, dword [esp]
mov byte [esp + edx + 8], al
mov eax, dword [esp]
mov edx, eax
xor edx, 1
and eax, 1
lea eax, [edx + eax*2]
mov dword [esp], eax
mov eax, dword [esp]
cmp eax, 0xf
jb 0x43b1c0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x4474b8]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [case.0x43b221.11]
mov edi, dword [edx]
xor ebx, ebx
cmp edi, edx
setne bl
jmp dword [ebx*4 + 0x4474d0]
mov eax, dword [edi + 0x28]
xor ebx, ebx
jmp dword [ebx*4 + 0x4474f0]
jmp esi
xor ebx, ebx
cmp dword [edi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x4474e8]
mov ebx, 1
jmp dword [ebx*4 + 0x4474f0]
mov ecx, dword [0x447500]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [case.0x43b221.4]
nop
nop
nop
jmp ecx
mov eax, dword [eax + 0x3c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401250
Capabilities:
Delete registry key
Manipulate safe mode programs

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401282
push str.Failed_to_get_SafeBoot_key_n
call fcn.00404566
add esp, 4
or eax, 0xffffffff
pop ecx
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
pop ecx
ret

Function at 0x4012a0
Capabilities:
Manipulate safe mode programs
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4012d6
push str.Failed_to_get_SafeBoot_key_n
call fcn.00404566
add esp, 4
or eax, 0xffffffff
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401315
push str.Failed_to_register_service_for_Safe_Mode_n
call fcn.00404566
add esp, 4
or eax, 0xffffffff
add esp, 0xc
ret
mov eax, str.Service
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401320
sub eax, edx
mov edx, dword [esp + 4]
add eax, 1
push eax
push str.Service
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
add esp, 0xc
ret
Function at 0x401350
Capabilities:
Terminate process

Disassembly:
mov eax, 0x271c
call fcn.0040f0d0
mov eax, dword [0x4142a8]
xor eax, esp
mov dword [esp + 0x2718], eax
mov eax, dword [esp + 0x2720]
push 0x4117f8
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], ecx
call fcn.00404516
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x4014da
push ebx
push ebp
push esi
push edi
push eax
call fcn.004039f9
add esp, 4
test eax, eax
jne 0x401468
jmp 0x4013b0
push 0x2710
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
xor esi, esi
xor bl, bl
xor edi, edi
call fcn.0040bb70
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004039f9
add esp, 0x10
test eax, eax
jne 0x401453
lea esp, [esp]
cmp bl, 0xa
je 0x401439
mov edx, dword [esp + 0x10]
push edx
call fcn.0040431b
mov bl, al
add esp, 4
cmp bl, 0xff
je 0x401412
cmp bl, 0xd
je 0x401412
cmp bl, 0xa
je 0x401412
cmp esi, 0x270f
je 0x401412
mov byte [esp + esi + 0x18], bl
add esi, 1
cmp bl, 0x3a
jne 0x401428
test edi, edi
jne 0x401428
mov byte [esp + esi + 0x17], 0
lea edi, [esp + 0x18]
lea ebp, [esp + esi + 0x18]
mov eax, dword [esp + 0x10]
push eax
call fcn.004039f9
add esp, 4
test eax, eax
je 0x4013e0
test esi, esi
je 0x401453
test edi, edi
je 0x401453
mov ecx, dword [esp + 0x14]
push ecx
push edi
call fcn.004039e6
add esp, 8
test eax, eax
je 0x401490
mov edx, dword [esp + 0x10]
push edx
call fcn.004039f9
add esp, 4
test eax, eax
je 0x4013b0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040492a
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x2728]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040373b
add esp, 0x271c
ret
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401495
sub eax, edx
add eax, 1
push eax
call fcn.00403e70
mov esi, eax
mov eax, ebp
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4014b3
sub eax, edx
add eax, 1
push eax
push ebp
push esi
call fcn.0040a0a0
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040492a
add esp, 0x10
mov eax, esi
jmp 0x401477
push str._nFAILED._Unable_to_open_config_file._Aborting._n
call fcn.00404566
add esp, 4
push 0xffffffffffffffff
call fcn.00404c22
int3
Function at 0x401b20
Capabilities:
Terminate process

Disassembly:
push str.Attempting_to_kill_process_n
call fcn.00401060
call fcn.00402ef0
push str.Terminating_process..._n
call fcn.00401060
mov eax, dword [esp + 0xc]
add esp, 8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x401b5b
push str.Killed_process_n
call fcn.00401060
add esp, 4
ret
push str.Problem_Killing_process_n
call fcn.00401060
pop ecx
ret

Function at 0x401b70
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4142a8]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x9c
lea eax, [esp + 4]
push 0
push eax
call fcn.0040bb70
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 5
jne 0x401bd2
cmp dword [esp + 8], 2
jne 0x401bd2
mov eax, 1
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0040373b
add esp, 0xa0
ret
mov ecx, dword [esp + 0x9c]
xor ecx, esp
xor eax, eax
call fcn.0040373b
add esp, 0xa0
ret

Function at 0x401bf0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x104
mov eax, dword [0x4142a8]
xor eax, esp
mov dword [esp + 0x100], eax
push 0xfa
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0xfa
call fcn.0040bb70
add esp, 0xc
lea ecx, [esp]
push ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 4]
push eax
push str._SimpleService__Current_username_is__s_n
call fcn.00401060
mov ecx, dword [esp + 0x108]
add esp, 8
xor ecx, esp
call fcn.0040373b
add esp, 0x104
ret

Function at 0x401db0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x401c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x4028d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x3028
call fcn.0040f0d0
mov eax, dword [0x4142a8]
xor eax, esp
mov dword [esp + 0x3020], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
push str.Removing_self_as_service___s__n
mov dword [esp + 0x18], 0xfff
call fcn.00401060
add esp, 8
lea ebx, [esp + 0xc]
call fcn.00401110
test eax, eax
jne 0x402a82
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.ImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a82
lea eax, [esp + 0x28]
xor edi, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402946
sub eax, edx
mov ebx, eax
je 0x402963
cmp byte [esp + 0x28], 0x22
jne 0x402963
mov edi, 1
jmp 0x40297d
push 0x411884
lea ecx, [esp + 0x102c]
push 0x1000
push ecx
call fcn.00404846
add esp, 0xc
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push 0x1000
push eax
call fcn.00404846
add esp, 0xc
test edi, edi
jne 0x4029b5
push 0x411884
lea ecx, [esp + 0x102c]
push 0x1000
push ecx
call fcn.00404846
add esp, 0xc
push str.__uninstallbyname
lea edx, [esp + 0x102c]
push 0x1000
push edx
call fcn.00404846
push esi
lea eax, [esp + 0x1038]
push 0x1000
push eax
call fcn.00404846
add esp, 0x18
test edi, edi
mov byte [esp + 0x2028], 0
jne 0x402a06
add ebx, 0xffffffef
push ebx
lea ecx, [esp + 0x2c]
push ecx
push 0x1000
lea edx, [esp + 0x2034]
push edx
jmp 0x402a1c
add ebx, 0xffffffed
push ebx
lea eax, [esp + 0x2d]
push eax
push 0x1000
lea ecx, [esp + 0x2034]
push ecx
call fcn.00403d5f
add esp, 0x10
lea edx, [esp + 0x1028]
push edx
push str._SimpleService__Running__s_n
call fcn.00401060
lea eax, [esp + 0x2030]
push eax
push str._SimpleService__WorkingDir__s_n
call fcn.00401060
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x203c]
push edx
lea eax, [esp + 0x1040]
push eax
call fcn.00402b70
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.0040373b
add esp, 0x3028
ret
mov ecx, dword [esp + 0x302c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040373b
add esp, 0x3028
ret
Function at 0x402aa0
Capabilities:
Delete registry key
Delete service
Stop service

Disassembly:
sub esp, 0x20
push ebx
push esi
push 0xf003f
push 0
push 0
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x402acc
mov ebx, str.OpenSCManager
call fcn.00401090
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
push edi
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x402af3
mov ebx, str.OpenService
call fcn.00401090
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea ebx, [esp + 0xc]
call fcn.00401110
test eax, eax
jne 0x402b1e
mov ecx, dword [esp + 0xc]
push str.Parameters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
call fcn.00401250
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402b45
mov ebx, 0x412674
call fcn.00401090
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x402b63
mov ebx, 0x412684
call fcn.00401090
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x402fb0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x44
push ebx
push 0x44
mov ebx, eax
lea eax, [esp + 8]
push 0
push eax
call fcn.0040bb70
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
push str.Calling_CreateProcess..._n
mov dword [esp + 0x14], 0x44
mov dword [esp + 0x40], 0x101
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], eax
mov word [esp + 0x44], 0
call fcn.00401060
push edi
push str.Command_line:__s_n
call fcn.00401060
push esi
push str.Working_Dir:__s_n
call fcn.00401060
add esp, 0x20
push ebx
lea ecx, [esp + 8]
push ecx
push esi
push 0
push 8
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x403045
mov ebx, str.CreateProcess
call fcn.00401090
xor eax, eax
pop ebx
add esp, 0x44
ret
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
push eax
mov dword [0x415b30], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40306c
mov ebx, str.CloseHandle__9_
call fcn.00401090
xor eax, eax
pop ebx
add esp, 0x44
ret
mov eax, 1
pop ebx
add esp, 0x44
ret

Function at 0x40373b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4142a8]
jne 0x403745
repz ret
jmp fcn.004051b3