joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803f251
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 0x98]
cmp dword [esi], 0
jne 0x1803f2ac
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x1803f2a8
jmp 0x1803f2a2
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
cmp eax, ebx
jae 0x1803f299
or ecx, 0xffffffff
sub ecx, ebx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x1803f2a8
cmp dword [esi + 4], 0
jg 0x1803f27d
xchg dword [esi], edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1803faed
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 2
pop esi
mov ecx, dword [edi + 0x80]
cmp ecx, dword [edi + 0x84]
je 0x1803fb20
xor eax, eax
cmp dword [ecx + 0x14], eax
setne al
mov dword [ebp - 0xc], eax
mov esi, eax
mov al, byte [edi + 0x8d]
mov bl, byte [edi + 0x11]
mov dword [ebp - 0xc], eax
call fcn.1801f853
mov ecx, dword [edi + 0xc]
inc eax
push esi
push ebx
push dword [ebp - 0xc]
mov dl, byte [eax]
call fcn.180412a2
add esp, 0xc
mov byte [edi + 0x8c], al
mov ecx, 0x181d8618
push eax
call fcn.1802652c
cmp byte [edi + 0x8c], 0
je 0x1803fb6d
call fcn.1801706c
test al, al
je 0x1803fb6d
mov cl, 1
xor ebx, ebx
jmp 0x1803fb71
xor ebx, ebx
mov cl, bl
call fcn.18076bae
mov edx, dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18014e17
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
je 0x1803fc4f
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1803fc4f
movzx ecx, byte [0x181dd05a]
neg ecx
sbb ecx, ecx
and ecx, 0x181dcf50
je 0x1803fbfb
push 7
pop edx
push 3
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008b5d
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.1800724f
push dword [ebp - 0xc]
movzx eax, byte [edi + 0x8c]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d__Current_dir___s_
push eax
call fcn.18007230
mov ecx, dword [ebp - 0xc]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, edi
call fcn.180404aa
mov cl, byte [edi + 0x8c]
call fcn.1804117a
push dword [edi + 0xc]
call fcn.180403c6
test al, al
je 0x1803fc2f
mov cl, byte [edi + 0x8c]
call fcn.18027562
test al, al
je 0x1803fc2f
mov edi, 0xa0430607
jmp 0x1803fc56
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [edi + 0xc]
call fcn.18040418
mov edi, eax
mov ecx, edi
call fcn.1801cd4c
mov esi, dword [ebp - 8]
test edi, edi
js 0x1803fc56
jmp 0x1803fc58
call fcn.1801bab5
mov edi, eax
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret
Function at 0x18040dac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call fcn.1801f853
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x18040ddd
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.180074fa
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push 0x20019
push edi
mov dword [ebp - 0x18], 0x181a193c
mov dword [ebp - 0x10], 0x200
call fcn.1801a29e
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x18040f52
lea ecx, [ebp - 0x18]
call fcn.1801b26e
test eax, eax
je 0x18040f4d
push str.Clients
lea ecx, [ebp - 0x18]
call fcn.1801a300
test al, al
je 0x18040f4d
push str.ClientState
lea ecx, [ebp - 0x18]
call fcn.1801a300
test al, al
je 0x18040f4d
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18040f4d
push ebx
push ebx
push ebx
push ebx
push str.path
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18040f4d
mov dword [ebp - 8], ebx
call fcn.18006f9c
push eax
lea ecx, [ebp - 8]
call fcn.180076af
lea eax, [ebp - 8]
push eax
push str.version
lea ecx, [ebp - 0x18]
call fcn.1801a883
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x18040f40
and dword [ebp - 0x1c], 0
call fcn.1801f853
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x18040ed9
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x1c]
call fcn.180074fa
and dword [ebp - 0xc], 0
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
mov edx, 0x181ade58
mov ecx, esi
call fcn.1801c756
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x18040f2d
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18009c0f
test al, al
je 0x18040f2b
mov ebx, 0xa043090b
jmp 0x18040f2d
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea ecx, [esi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
jmp 0x18040f52
mov ebx, 0x80070003
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x181a193c
je 0x18040f73
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x200
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret
Function at 0x18041c8a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815df20
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18041e7b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.18137120
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180428b0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18041d11
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x18041e7b
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x18041d23
mov eax, edi
jmp 0x18041e7d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18041d48
call fcn.1801bab5
mov esi, eax
jmp 0x18041e77
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18083d0c
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x18041d7e
call fcn.1801bab5
mov esi, eax
jmp 0x18041e62
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18044406
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18041df1
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18041db0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b1000
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041e45
call fcn.1801bab5
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18041e50
push esi
call fcn.18122d23
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x18041e7d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122478
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18041e90
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18041f34
call fcn.1804298c
test al, al
jne 0x18041f34
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18041ed7
call fcn.1801bab5
mov ebx, eax
jmp 0x18041f30
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083d0c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18041f0c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041f17
call fcn.1801bab5
mov ebx, eax
test esi, esi
je 0x18041f1e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18041f36
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret
Function at 0x1804215b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815df20
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015cbc
test al, al
je 0x1804234c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.18137120
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18042d19
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x180421e2
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x1804234c
mov ecx, edi
call fcn.1801cd4c
test edi, edi
jns 0x180421f4
mov eax, edi
jmp 0x1804234e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18042219
call fcn.1801bab5
mov esi, eax
jmp 0x18042348
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18083c4f
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1804224f
call fcn.1801bab5
mov esi, eax
jmp 0x18042333
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18044406
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x180422c2
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18042281
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b1000
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18042316
call fcn.1801bab5
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18042321
push esi
call fcn.18122d23
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1804234e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122478
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18042361
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015cbc
test al, al
je 0x18042405
call fcn.18042df5
test al, al
jne 0x18042405
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180423a8
call fcn.1801bab5
mov ebx, eax
jmp 0x18042401
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083c4f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180423dd
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x180423e8
call fcn.1801bab5
mov ebx, eax
test esi, esi
je 0x180423ef
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18042407
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret

Function at 0x18042a64
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18043724
test al, al
je 0x18042a8c
xor eax, eax
jmp 0x18042b3f
call fcn.18041fdb
mov esi, eax
mov ecx, esi
call fcn.1801cd4c
test esi, esi
jns 0x18042aa8
lfence
mov eax, esi
jmp 0x18042b3f
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18042ad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042b3d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042b3d
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083d0c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18042b0b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18042b24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042b20
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18042b2b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret
Function at 0x18042ecd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.180438d2
test al, al
je 0x18042ef5
xor eax, eax
jmp 0x18042fa8
call fcn.180424ac
mov esi, eax
mov ecx, esi
call fcn.1801cd4c
test esi, esi
jns 0x18042f11
lfence
mov eax, esi
jmp 0x18042fa8
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18042f3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042fa6
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042fa6
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083c4f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18042f74
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18042f8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042f89
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18042f94
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret

Function at 0x18042fb7
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x18042ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18043071
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18043071
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18083c4f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18043846
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18043050
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18043057
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18043057
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret
Function at 0x18043de5
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.1800790f
push dword [eax + 4]
push dword [eax]
call fcn.1813ea3b
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x18043e4b
push eax
call fcn.181467c1
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x18043e7a
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18122478
leave
ret

Function at 0x18044115
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d8f60
push edi
mov edi, ecx
cmp dword [0x181d8f60], ebx
je 0x18044156
push ecx
mov ecx, esi
call fcn.1803cb31
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x180441c4
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18044138
lfence
cmp byte [edi + 0x3c], 0
je 0x180441d2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x180441cb
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18044320
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18044199
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180441cb
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180441bb
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180441da
lfence
mov eax, ebx
jmp 0x180441e5
mov esi, 0x80004005
jmp 0x180441de
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180441e3
call fcn.180440d1
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret 4
Function at 0x1804423a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d9030
push edi
mov edi, ecx
cmp dword [0x181d9030], ebx
je 0x1804427b
push ecx
mov ecx, esi
call fcn.1803cb31
mov ebx, eax
mov ecx, ebx
call fcn.1801cd4c
test ebx, ebx
js 0x180442e9
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x1804425d
lfence
cmp byte [edi + 0x3c], 0
je 0x180442f7
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x180442f0
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18044320
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x180442be
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180442f0
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x180442e0
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180442ff
lfence
mov eax, ebx
jmp 0x1804430a
mov esi, 0x80004005
jmp 0x18044303
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18044308
call fcn.180441f6
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret 4

Function at 0x1804781b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.18048ed9
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18047845
mov ecx, edi
call fcn.18087c44
push 0x24
push edi
call fcn.181229a6
pop ecx
pop ecx
mov ecx, dword [0x181dcefc]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803f251