joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push esi
call fcn.00423d00
push eax
push dword [ebp + 8]
call fcn.00423630
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x42325b
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0xffffffff
jne 0x423279
mov edi, edx
lea ebx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x423270
sub edi, ebx
push ecx
push edi
push 1
push edx
call fcn.00548914
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x423322
push esi
call fcn.00423ac0
add esp, 4
test eax, 0x1000
jne 0x423301
push esi
call fcn.00423ac0
and eax, 0xf
add esp, 4
cmp al, 6
ja 0x423322
push esi
call fcn.00423ac0
and eax, 0xf
add esp, 4
cmp al, 5
jbe 0x423301
push esi
call fcn.00423ac0
add esp, 4
test eax, 0x1300
jne 0x423301
push esi
call fcn.00423ac0
push dword [ebp + 0x14]
mov esi, eax
and esi, 0xc90000
or esi, 0x360000
shr esi, 0x10
call fcn.00423ac0
and eax, 0xf
add esp, 8
cmp dword [esi*4 + 0x601b40], eax
jl 0x423322
mov esi, dword [ebp + 0x14]
push ebx
push edi
push dword [ebp + 8]
push str.failed_fwrite__s__sz__d__returned__d
push esi
call fcn.00423ac0
add esp, 4
or eax, 0x360000
push eax
call fcn.00424230
add esp, 0x14
push dword [ebp - 4]
call fcn.00548536
add esp, 4
sub ebx, edi
neg ebx
sbb ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4233c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x10000
call fcn.00541565
mov esi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push esi
or edi, 0xffffffff
call fcn.0053c5e0
add esp, 0xc
test eax, eax
jne 0x4234a3
push 0x56eb04
push esi
call fcn.0053be80
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x4234a3
push 0x56ec78
push dword [ebp + 0xc]
call fcn.0053be80
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x423488
mov edi, dword [ebp - 0x2c]
mov ecx, edi
mov ebx, dword [ebp - 0x28]
or ecx, ebx
je 0x42347e
nop
test ebx, ebx
jl 0x423445
jg 0x42343e
cmp edi, 0x10000
jbe 0x423445
mov esi, 0x10000
jmp 0x423447
mov esi, edi
push dword [ebp - 8]
push esi
push 1
push dword [ebp - 4]
call fcn.00541ecc
add esp, 0x10
cmp eax, esi
jne 0x423482
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.00548914
add esp, 0x10
cmp eax, esi
jne 0x423482
mov eax, esi
cdq
sub edi, eax
mov eax, edi
sbb ebx, edx
or eax, ebx
jne 0x423430
xor edi, edi
jmp 0x423485
or edi, 0xffffffff
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call fcn.00548536
mov eax, dword [ebp - 0xc]
add esp, 4
test eax, eax
je 0x4234a3
push eax
call fcn.00548536
add esp, 4
push ebx
call fcn.00541560
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4237c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push fcn.00422230
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420810
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [0x5fd8bc]
test eax, eax
jne 0x423914
push esi
push str.TEMP
call fcn.0053b4f0
add esp, 4
test eax, eax
jne 0x4238aa
push 0x56eb40
call fcn.0053b4f0
add esp, 4
test eax, eax
jne 0x4238aa
push dword [ebp - 4]
call fcn.004222a0
mov eax, dword [ebp - 4]
add esp, 4
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x423860
push esi
push dword [ebp - 4]
call fcn.004222c0
mov ecx, dword [ebp - 4]
add esp, 8
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 4]
push dword [eax]
push 0x5fd8bc
call fcn.00421a30
jmp 0x4238b5
push 0x56eb44
call fcn.0053b4f0
add esp, 4
test eax, eax
je 0x423918
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x5dfce8], 4
je 0x423918
cmp byte [eax + 1], 0x3a
jne 0x423918
movsx eax, dl
push eax
push str._c:_Temp
push 0x5fd8bc
call fcn.00421960
add esp, 0xc
jmp 0x4238b8
push eax
push 0x5fd8bc
call fcn.004218d0
add esp, 8
lea eax, [ebp - 0x3c]
push eax
push dword [0x5fd8bc]
call fcn.0053c5e0
add esp, 8
pop esi
test eax, eax
jne 0x4238e3
movzx eax, word [ebp - 0x36]
test eax, eax
je 0x4238e3
and eax, 0xf000
cmp eax, 0x4000
je 0x42390f
push dword [0x5fd8bc]
push str.creating_temp_directory__s
push 0x360004
call fcn.00424230
push 0x1ff
push dword [0x5fd8bc]
call fcn.0053ba60
add esp, 0x14
test eax, eax
jne 0x423927
mov eax, dword [0x5fd8bc]
mov esp, ebp
pop ebp
ret
push str.failed_to_get_temp_directory
push 0x360000
call fcn.00424790
push str.failed_to_create_temp_directory
push 0x360000
call fcn.00424790
int3
Function at 0x424bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 2
call fcn.00541c6e
mov edi, dword [ebp + 0x10]
add esp, 4
mov ecx, edi
mov ebx, edi
sar ecx, 0x10
and ebx, 0xf
movzx ecx, cl
mov esi, eax
lea eax, [ebp - 0x100]
mov dword [ebp + 0x10], ecx
cmp dword [ecx*4 + 0x601b40], ebx
jge 0x424c16
test edi, 0x300
je 0x424d13
cmp dword [0x601f40], 0
je 0x424c42
call fcn.00425010
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00537d30
mov cx, word [0x56ecf8]
add esp, 8
mov word [eax], cx
inc eax
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx + ecx*2]
push dword [ecx*4 + 0x5edc5c]
push eax
call fcn.00537d30
movzx ecx, word [0x56ecf8]
mov word [eax], cx
inc eax
push dword [ebx*4 + 0x5ed040]
push eax
call fcn.00537d30
movzx ecx, word [0x56ecf4]
mov ebx, eax
mov word [ebx], cx
mov cl, byte [0x56ecf6]
mov byte [ebx + 2], cl
add ebx, 2
lea ecx, [ebp - 1]
sub ecx, ebx
push ecx
push dword [ebp + 0xc]
push ebx
call fcn.00537bf0
add esp, 0x1c
lea ecx, [ebp - 1]
push esi
push 1
cmp eax, ecx
jae 0x424cb8
mov byte [eax], 0xa
lea ecx, [ebp - 0x100]
sub eax, ecx
inc eax
push eax
mov eax, ecx
push eax
call fcn.00548914
add esp, 0x10
jmp 0x424cde
lea eax, [ebp - 0x100]
sub ebx, eax
push ebx
push eax
call fcn.00548914
push esi
push dword [ebp + 0xc]
call fcn.00547ff1
push esi
push 0x56e9c0
call fcn.00547ff1
add esp, 0x20
mov eax, dword [0x5ed874]
cmp eax, 0xffffffff
jne 0x424cfc
push esi
call fcn.0053b470
push eax
call fcn.0053b9f0
add esp, 8
mov dword [0x5ed874], eax
test eax, eax
mov ecx, 0x2000
cmovne edi, ecx
test ecx, edi
je 0x424d13
push esi
call fcn.00548afa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425de0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test esi, esi
je 0x425e03
mov ebx, esi
jmp 0x425e0a
call fcn.0053b9e0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
push str.SeDebugPrivilege
mov dword [ebp + 0x10], 0
call fcn.00443a70
add esp, 8
test eax, eax
je 0x425e47
push str.failed_privilege_enable
push 0x360003
call fcn.00424230
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x425e8a
push ebx
push 0
push 0xfffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call fcn.0053b430
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x425e83
push str.failed_OpenProcess:__m
push 0x360003
call fcn.00424230
add esp, 8
or ebx, 0xffffffff
jmp 0x425f41
mov dword [ebp + 0x10], 1
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edi
call fcn.00443910
mov ecx, eax
add esp, 0x1c
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x425eca
push edi
push str.failed_z_CreateFile__s:__m
push 0x360003
call fcn.00424230
add esp, 0xc
or ebx, 0xffffffff
jmp 0x425f40
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0x20], eax
test esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
cmovne eax, edx
mov dword [ebp - 0x14], 0x4265b0
cmp dword [ebp + 0x14], 0
mov edx, 7
push eax
mov eax, 0x11a0
mov dword [ebp - 0x10], 0
cmove eax, edx
push eax
push ecx
push ebx
push dword [ebp - 4]
call dword [0x5fd9f4]
push eax
call fcn.0053b400
xor ebx, ebx
add esp, 4
test eax, eax
sete bl
test eax, eax
jne 0x425f40
push edi
push str.failed_MiniDumpWriteDump__s:__m
push 0x360003
call fcn.00424230
add esp, 0xc
pop edi
lea eax, [ebp - 0x30]
push eax
call fcn.00443ad0
lea eax, [ebp - 8]
push eax
call fcn.004438e0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x425f68
lea eax, [ebp - 4]
push eax
call fcn.004438e0
add esp, 4
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426060
Capabilities:
Acquire debug privileges
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x426090
push eax
call fcn.00541560
add esp, 4
mov dword [edi], 0
lea eax, [ebp - 0x34]
push eax
push str.SeDebugPrivilege
call fcn.00443a70
add esp, 8
test eax, eax
jne 0x4261c7
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x4260b8
call fcn.0053b9e0
mov ebx, eax
push ebx
call fcn.00427300
add esp, 4
test eax, eax
jne 0x4261b1
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
test eax, eax
je 0x4261c6
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x4261b1
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x1c], eax
jne 0x426111
call fcn.0053b9e0
cmp ebx, eax
jne 0x426111
mov esi, 1
jmp 0x426113
xor esi, esi
cmp dword [ebp - 0x18], ebx
jne 0x42618e
push dword [ebp - 0x1c]
push str.Thread__ld:_n
push edi
call fcn.00421610
add esp, 0xc
push dword [ebp - 0x1c]
push 0
push 0xfffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push eax
call fcn.0053b430
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x426159
push str.Failed_opening_the_thread:__m_n
push edi
call fcn.00421610
add esp, 8
jmp 0x42618e
test esi, esi
je 0x4261ce
lea eax, [ebp - 0x300]
push eax
call dword [0x5fda08]
push dword [ebp + 0x10]
lea eax, [ebp - 0x300]
push dword [ebp - 4]
push ebx
push eax
push edi
call fcn.00426370
add esp, 0x14
test esi, esi
jne 0x42618e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.004438e0
add esp, 4
test esi, esi
jne 0x4260f6
pop esi
lea eax, [ebp - 0x34]
push eax
call fcn.00443ad0
lea eax, [ebp - 8]
push eax
call fcn.004438e0
add esp, 8
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push eax
call fcn.0053b400
add esp, 4
cmp eax, 0xffffffff
jne 0x4261f3
push str.Failed_to_suspend_the_thread:__m_n
push edi
call fcn.00421610
add esp, 8
jmp 0x42618e
lea eax, [ebp - 0x300]
mov dword [ebp - 0x300], 0x1001f
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x42616a
push str.Failed_getting_thread_context:__m_n
push edi
call fcn.00421610
add esp, 8
jmp 0x426185
Function at 0x426c30
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
xor ebx, ebx
lea eax, [ebp - 0x44c]
push 0x428
push ebx
push eax
mov dword [ebp - 0xc], ebx
call fcn.0053f310
add esp, 0xc
mov dword [ebp - 0x44c], 0x428
push dword [ebp + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
xor edx, edx
cmp ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
cmove eax, edx
test eax, eax
je 0x426e18
lea eax, [ebp - 0x44c]
push eax
push ecx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x426e18
push esi
lea esi, [ebp + 4]
add esi, 0xfffffffc
push edi
mov dword [ebp - 0x24], esi
mov edi, 0x41c64e6d
lea eax, [ebp - 0x22c]
push eax
push esi
call fcn.00420d10
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
push esi
call fcn.00420d10
mov esi, dword [ebp - 0x438]
push 1
push 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], esi
call fcn.00541555
push dword [ebp - 4]
mov ebx, dword [0x5fda3c]
mov dword [ebp - 0x20], eax
mov eax, esi
mul edi
mov edi, eax
mov esi, edx
call fcn.004225d0
mov ecx, dword [ebx + 4]
sub edi, esi
mov edx, eax
add esp, 0x1c
mov eax, dword [ebx + 8]
xor edx, edi
mov edi, dword [ebp - 8]
and ecx, edx
mov dword [ebp - 0x14], edx
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x426d63
mov ebx, dword [ebp - 4]
nop dword [eax + eax]
cmp edx, dword [esi]
jne 0x426d5c
cmp edi, dword [esi + 0x10]
jne 0x426d5c
mov eax, dword [esi + 0x1c]
mov ecx, ebx
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x426d50
test dl, dl
je 0x426d4c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x426d50
add ecx, 2
add eax, 2
test dl, dl
jne 0x426d30
xor eax, eax
jmp 0x426d55
sbb eax, eax
or eax, 1
test eax, eax
je 0x426dcc
mov edx, dword [ebp - 0x14]
mov esi, dword [esi + 4]
test esi, esi
jne 0x426d20
push 1
push 0x30
call fcn.00541555
push dword [ebp - 0x1c]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], 0
call fcn.004218d0
push dword [ebp - 4]
lea eax, [esi + 0x1c]
push eax
call fcn.004218d0
mov ecx, dword [0x5ed884]
push 0
push esi
mov dword [esi + 0xc], ecx
lea eax, [ecx + 4]
mov dword [0x5ed884], eax
call fcn.00426e40
push esi
push dword [0x5fda3c]
call fcn.00426970
mov eax, dword [0x5fda3c]
add esp, 0x28
cmp dword [eax + 0xc], 0x3e8
jge 0x426e2b
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov dword [ecx + 8], esi
test ebx, ebx
je 0x426de9
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov dword [ebx + 4], ecx
mov eax, dword [ecx + 4]
mov dword [eax], ecx
jmp 0x426df1
mov ebx, ecx
mov dword [ecx + 4], ecx
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x44c]
mov dword [ecx], 0
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32NextW
mov esi, dword [ebp - 0x24]
mov edi, 0x41c64e6d
test eax, eax
jne 0x426ca2
pop edi
pop esi
lea eax, [ebp - 0x10]
push eax
call fcn.004438e0
add esp, 4
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push str.using_more_than_1000_module_entries
push 0x36
call fcn.004205f0
int3
Function at 0x4289e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x428610
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420810
lea ecx, [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 8], 0xffffffff
push eax
mov dword [ebp - 4], 0
call fcn.00421980
add esp, 0x18
cmp dword [0x601c18], 6
jl 0x428a3c
mov eax, dword [ebp - 0xc]
push dword [eax]
push str.sys_exec__s_
push 0x360006
call fcn.00424230
add esp, 0xc
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.00428b50
add esp, 4
test eax, eax
jns 0x428a76
cmp dword [0x601c18], 6
jl 0x428b30
mov eax, dword [ebp - 0xc]
push dword [eax]
push str.failed_sys_exec_bg__s_
push 0x360006
call fcn.00424230
add esp, 0xc
jmp 0x428b30
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.00429c60
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ebx, eax
mov eax, edx
mov ecx, ebx
mov dword [ebp - 0x10], eax
mov esi, eax
mov eax, dword [0x5fda4c]
test eax, eax
je 0x428ac7
imul eax, eax, 0x3e8
cdq
sub eax, ecx
sbb edx, esi
add eax, ebx
adc edx, dword [ebp - 0x10]
test edx, edx
ja 0x428ac2
jb 0x428ab5
test eax, eax
jne 0x428ac2
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
jmp 0x428ad1
mov dword [ebp - 0x14], edx
jmp 0x428ad1
or eax, 0xffffffff
mov dword [ebp - 0x14], 0
push 1
push eax
push dword [ebp - 4]
call edi
cmp eax, 0xc0
jne 0x428aeb
call fcn.00429c60
mov ecx, eax
mov esi, edx
jmp 0x428a92
pop edi
pop esi
pop ebx
test eax, eax
je 0x428b06
push 0x16
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], 0xfffffff7
jmp 0x428b24
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 8]
mov ecx, 0xffffffea
cmp eax, 3
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.004438e0
add esp, 4
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x15f8], eax
mov esp, ebp
pop ebp
ret

Function at 0x429030
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
neg eax
sbb eax, eax
inc eax
pop ebp
ret

Function at 0x4290a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0x14
call fcn.00541555
mov ecx, dword [ebp + 8]
mov esi, eax
push 0
push 0
push esi
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
push 0x429220
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x10]
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 2
call fcn.005497a3
add esp, 0x20
mov dword [esi], eax
pop esi
test eax, eax
je 0x4290e8
xor eax, eax
pop ebp
ret
push str.failed_create_thread:__m
push 0x360000
call fcn.00424790
int3
Function at 0x430fb0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
or esi, 0xffffffff
cmp dword [0x5fdc84], 0
push edi
je 0x431052
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420ed0
add esp, 8
push 0x10000
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b430
mov edi, eax
add esp, 4
test edi, edi
je 0x431052
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x431024
push dword [ebp + 8]
push str.Failed_deleting_service__s:__m
push 0x550003
call fcn.00424230
add esp, 0xc
jmp 0x431026
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x43104c
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.00424230
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x431069
call fcn.00541542
mov eax, dword [eax]
sub eax, 0x424
neg eax
pop edi
sbb eax, eax
pop esi
pop ebp
ret

Function at 0x431080
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp dword [0x5fdc84], esi
je 0x431134
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00420ed0
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b430
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x431134
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x431102
push edi
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.00424230
add esp, 0xc
test eax, eax
jne 0x431105
mov esi, dword [ebp - 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x431147
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.00424230
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.service__s_doesnt_exist
push 0x550005
call fcn.00424230
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431150
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
or esi, 0xffffffff
cmp dword [0x5fdc84], 0
push edi
mov edi, dword [ebp + 8]
je 0x431207
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00420ed0
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b430
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x431207
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x4311d5
push edi
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.00424230
add esp, 0xc
test eax, eax
jne 0x4311d8
mov esi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x43121a
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.00424230
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.service__s_doesnt_exist
push 0x550005
call fcn.00424230
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431590
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x24
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x4315ce
push dword [ebp + 0x10]
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.00424230
add esp, 0xc
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x431870
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x1c]
lea esi, [ebp + 4]
add esi, 0xfffffffc
push esi
call fcn.00420ed0
push dword [ebp + 0xc]
push esi
mov edi, dword [eax]
call fcn.00420ed0
push dword [ebp + 8]
push esi
mov ebx, dword [eax]
call fcn.00420ed0
add esp, 0x18
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
push eax
call fcn.0053b430
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x431950
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
or edi, 0xffffffff
mov eax, dword [ebx]
test eax, eax
je 0x431970
push eax
call fcn.00541560
add esp, 4
mov dword [ebx], 0
push 1
push 0x200
call fcn.00541555
add esp, 8
mov dword [ebx], eax
lea ecx, [ebp + 0xc]
push ecx
push 0x200
push eax
push dword [ebp + 8]
call sub.PSAPI.DLL_EnumProcessModules
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x4319d6
cmp dword [0x601c94], 6
jl 0x4319bb
push str.EnumProcessModules_failed:__m
push 0x550006
call fcn.00424230
add esp, 8
mov eax, dword [ebx]
test eax, eax
je 0x431a24
push eax
call fcn.00541560
add esp, 4
mov dword [ebx], 0
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
shr edi, 2
cmp edi, 0x80
jb 0x431a24
push esi
lea esi, [edi*8]
push esi
push dword [ebx]
call fcn.005479c7
add esp, 8
mov dword [ebx], eax
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push dword [ebp + 8]
call sub.PSAPI.DLL_EnumProcessModules
push eax
call fcn.0053b400
add esp, 4
pop esi
test eax, eax
je 0x431a2a
mov ecx, dword [ebp + 0xc]
lea eax, [edi + edi]
shr ecx, 2
cmp ecx, eax
jae 0x431a39
mov edi, ecx
mov eax, edi
pop edi
pop ebx
pop ebp
ret
push str.EnumProcessModules_2nd_failed:__m
push 0x550000
call fcn.00424790
push str.EnumProcessModules_no_space
push 0x550000
call fcn.00424790
int3

Function at 0x431b30
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x431b77
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push eax
call fcn.0053b400
add esp, 4
test eax, eax
jne 0x431bac
push str.failed_CheckTokenMembership__:__m
push 0x550003
call fcn.00424230
add esp, 8
mov dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret