joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d800
Capabilities:
Modify service

Disassembly:
sub esp, 0x118
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x11c]
push ebp
push edi
push str.SYSTEMCurrentControlSetServices
push 0x80000002
mov edi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
call fcn.00414a40
mov ebp, eax
test ebp, ebp
jne 0x40d862
push str.PostInstall:Unable_to_open_services_n
call fcn.0040b8e0
add esp, 4
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00416a72
add esp, 0x118
ret
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
mov dword [esp + 0x14], 0
mov byte [esp + 0x20], 0
call fcn.00414a10
mov dword [esp + 0x14], eax
test eax, eax
je 0x40d8a6
push 0x104
lea edx, [esp + 0x1c]
push edx
push str.DirProductBase
push eax
call fcn.00414a70
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x428550
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
push ebp
call fcn.00414a10
mov edi, eax
test edi, edi
jne 0x40d917
push esi
push str.PostInstall:_s_Not_Found_in_Services__Registering_n
call fcn.0040b8e0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x130]
add esp, 8
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ecx
push esi
call fcn.004145a0
cmp eax, 1
je 0x40d9c5
push esi
push str.PostInstall:_s_Failed_to_Register_n
jmp 0x40d9bd
lea edx, [esp + 0xc]
push edx
push str.DeleteFlag
push edi
mov dword [esp + 0x18], 5
call fcn.00414ac0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
cmp eax, 5
je 0x40d950
push eax
push esi
push str.PostInstall:_s_Service_is_marked_for_deletion__d__n
call fcn.0040b8e0
add esp, 0xc
jmp 0x40d9c5
test ebx, ebx
je 0x40d9b7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 8], eax
test eax, eax
je 0x40d9c5
push 2
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40d9aa
push 0
push 0
push 0
push ebx
push 0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push str.PostInstall:_s_Service_is_Installed_was_re_Configured_n
call fcn.0040b8e0
add esp, 8
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40d9c5
push esi
push str.PostInstall:_s_Service_Installed_n
call fcn.0040b8e0
add esp, 8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00416a72
add esp, 0x118
ret
Function at 0x40db00
Capabilities:
Persist via run registry key

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x2000
xor edi, edi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40dbc7
push ebp
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
lea ebp, [esi + 0x400]
mov byte [esi], bl
call fcn.00414a10
mov ebx, eax
test ebx, ebx
je 0x40db5f
push 0x104
push esi
push str.DirProductBase
push ebx
call fcn.00414a70
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x40dba3
push str.K7TSStart.exe
push esi
push str.__s_s___UpgradeComplete__spawnnow
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.004149d0
mov edi, eax
test edi, edi
je 0x40dba7
push ebp
push str.K7TS12WoW
push edi
call fcn.00414b10
cmp eax, 1
jne 0x40dba7
mov ebx, eax
jmp 0x40dbab
mov ebx, edi
jmp 0x40dbab
mov ebx, dword [esp + 0x10]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebp
test edi, edi
je 0x40dbc7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x40e070
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x42b038
push 1
push 0
push 0x42b028
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x40e0cf
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x40e0cf
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x40e0df
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
test eax, eax
je 0x40e0ef
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x40e810
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x170
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [esp + 0x24]
push ebx
push eax
mov edi, ecx
mov dword [esp + 0x28], 0xdeadcafe
call fcn.0041a140
xor eax, eax
push 0x1000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.00416def
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x40e94d
push 0xfa0
push edi
push esi
mov byte [esi], bl
call fcn.004187e4
add esp, 0xc
cmp eax, ebx
je 0x40e883
cmp eax, 0xffffffff
jne 0x40e893
push edi
push 0x42b150
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dx, word [esp + 0x184]
or dword [esp + 0x4c], 1
push 0x104
lea eax, [esp + 0x6c]
push eax
mov word [esp + 0x58], dx
mov byte [esp + 0x70], bl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40e904
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.00416a72
add esp, 0x170
ret
cmp dword [esp + 0x180], 1
jne 0x40e92b
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
push esi
mov ebx, 1
call fcn.00416ce5
add esp, 4
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00416a72
add esp, 0x170
ret
Function at 0x40eba0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
push 4
push ebx
push ebx
mov dword [esp + 0x14], 1
mov dword [edi + 0x684], ebx
mov dword [edi + 0x680], ebx
mov dword [edi + 0x688], ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [edi + 0x688], eax
cmp eax, ebx
jne 0x40ebd8
xor eax, eax
pop ebx
pop ecx
ret
push ebp
push esi
lea ebp, [edi + 0x68c]
lea esi, [edi + 0x9ec]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor ecx, ecx
mov dword [esi - 8], eax
cmp eax, ecx
je 0x40ec70
mov dword [esi - 0x1c], ebx
mov dword [esi], 1
mov dword [esi - 4], ecx
mov dword [esi - 0x14], edi
mov dword [esi - 0xc], ecx
mov dword [esi - 0x18], ecx
mov dword [ebp], ecx
inc ebx
add ebp, 4
add esi, 0x354
cmp ebx, 4
jb 0x40ebe6
xor ebp, ebp
lea ebx, [edi + 0x68c]
lea esi, [edi + 0x69c]
jmp 0x40ec36
xor ecx, ecx
lea eax, [esi + 0x340]
push eax
push ecx
push esi
push 0x40ea90
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx], eax
test eax, eax
je 0x40ec70
inc dword [edi + 0x684]
inc ebp
add ebx, 4
add esi, 0x354
cmp ebp, 4
jb 0x40ec34
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x40ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add esi, 4
mov ebx, dword [esi + 4]
add esi, 4
push edi
mov dword [esp + 0x10], eax
lea eax, [ebx + eax + 0x800005]
xor ebp, ebp
push eax
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40eddd
mov edx, dword [esp + 0x10]
lea eax, [ebx + 5]
push eax
add esi, 4
lea ebp, [edx + edi + 4]
push esi
push ebp
call fcn.0041a520
mov eax, dword [esp + 0x30]
add esp, 0xc
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
add ebp, 5
push ebp
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ebx
call fcn.004150e0
test eax, eax
jne 0x40edc1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40edc1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
jne 0x40edc1
mov dword [esp + 0x18], 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x40fa40
Capabilities:
Create directory
Set current directory

Disassembly:
sub esp, 0x410
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x18], eax
mov edi, ecx
mov dword [esp + 0x10], 1
mov esi, str._ProgramFilesFolder_
xor ebx, ebx
mov eax, dword [esi + 0x40]
push eax
push edi
push esi
mov dword [esp + 0x20], eax
call fcn.00419f8a
add esp, 0xc
test eax, eax
je 0x40faa9
add ebx, 0x24c
inc ebp
add esi, 0x24c
cmp ebx, 0x14ac
jb 0x40fa76
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x40facb
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, ebp
imul ecx, ecx, 0x24c
add ecx, 0x430550
push ecx
call ebx
test eax, eax
je 0x40fb0c
mov edx, dword [esp + 0x14]
lea edi, [edi + edx*2]
xor eax, eax
cmp ax, word [edi]
je 0x40fbf6
cmp ebp, 9
je 0x40fade
add edi, 2
mov ecx, 0x2e
cmp cx, word [edi]
jne 0x40fb48
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 0x10c]
push esi
call ebx
test eax, eax
jne 0x40fb13
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40fb0c
push esi
call ebx
test eax, eax
jne 0x40fb13
xor eax, eax
jmp 0x40fbfa
lea esi, [ebp + 0x20c]
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40fb35
push eax
push esi
call ebp
test eax, eax
je 0x40fb0c
push esi
call ebx
test eax, eax
je 0x40fb0c
add edi, 2
xor edx, edx
cmp dx, word [edi]
je 0x40fbf6
add edi, 2
jmp 0x40fb4e
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call ebx
test eax, eax
jne 0x40fbf6
push eax
push edi
call ebp
test eax, eax
je 0x40fb6c
push edi
call ebx
test eax, eax
jne 0x40fbf6
lea edx, [esp + 0x1c]
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40fb74
xor eax, eax
lea esi, [esp + 0x1c]
mov edi, esi
cmp ax, word [esp + 0x1c]
je 0x40fbd8
mov ecx, 0x5c
cmp cx, word [esi]
jne 0x40fbce
xor edx, edx
push edi
mov word [esi], dx
call ebx
test eax, eax
jne 0x40fbbf
push eax
push edi
call ebp
test eax, eax
je 0x40fb0c
push edi
call ebx
test eax, eax
je 0x40fb0c
mov eax, 0x5c
mov word [esi], ax
add esi, 2
mov edi, esi
jmp 0x40fbd1
add esi, 2
xor ecx, ecx
cmp cx, word [esi]
jne 0x40fb92
push edi
call ebx
test eax, eax
jne 0x40fbf6
push eax
push edi
call ebp
test eax, eax
je 0x40fb0c
push edi
call ebx
test eax, eax
je 0x40fb0c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00416a72
add esp, 0x410
ret
Function at 0x410a50
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x67c]
push esi
push edi
mov esi, 1
mov dword [esp + 0x14], eax
xor ebx, ebx
mov ecx, dword [ebp + 0x368]
cmp dword [ecx + ebx*8], 0
lea eax, [ecx + ebx*8]
jne 0x410a7e
cmp dword [eax + 4], 0
je 0x410aa5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410aa5
mov edx, dword [esp + 0x14]
cmp dword [edx + 8], eax
je 0x410aa3
mov edi, str.Break_1
mov esi, str.K7IS_Parser_Remove_CustomActionDlls
call fcn.00412cb0
xor esi, esi
mov eax, dword [ebp + 0x108]
inc ebx
inc eax
cmp ebx, eax
jbe 0x410a69
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x412cb0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x720
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x718], eax
cmp dword [0x4395b0], 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jne 0x412d7e
push 0xfc
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x24], 0
call fcn.0041a140
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x412de0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x10]
movzx ecx, word [esp + 0xe]
movzx edx, word [esp + 0xc]
push eax
movzx eax, word [esp + 0xe]
push ecx
movzx ecx, word [esp + 0xe]
push edx
movzx edx, word [esp + 0x10]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x134]
push str._sTempK7Installer_Info_Log__d__d__d__d__d__d.txt
push ecx
call ebx
add esp, 0x24
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea edx, [esp + 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4395b0], eax
test eax, eax
je 0x412de0
push esi
push edi
lea eax, [esp + 0x320]
push str.TITLE___s___:_DESCRIPTION___s___r_n
push eax
call ebx
lea eax, [esp + 0x328]
add esp, 0x10
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412da0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x4395b0]
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x324]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412de0
mov edx, dword [0x4395b0]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esp + 0x71c]
pop ebx
xor ecx, esp
call fcn.00416a72
add esp, 0x720
ret
Function at 0x413480
Capabilities:
Read pipe
Write pipe

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x3c]
push str..pipeK7RTScanPipeV1
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], 8
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x28], 0xffffffff
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x41351a
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x4134e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x413515
push 0xffffffffffffffff
push str..pipeK7RTScanPipeV1
call ebx
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipeK7RTScanPipeV1
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4134e0
jmp 0x41351a
cmp esi, 0xffffffff
je 0x413579
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x24], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x41356d
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push 0x14
lea edx, [esp + 0x2c]
push edx
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x41356d
cmp dword [esp + 0x10], 4
je 0x41356d
mov dword [esp + 0xc], 0xffffffff
cmp esi, 0xffffffff
je 0x413579
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x413620
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push 0x80000000
push 0
push 0
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call ebx
mov dword [esi], eax
test ebp, ebp
jne 0x413650
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
push edi
push 4
push str.K7RTScan
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
call ebx
mov dword [esi], eax
test edi, edi
jne 0x41367a
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
test ebx, ebx
je 0x4136a9
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov ebx, 1
mov dword [edx], ecx
mov dword [esi], eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret
Function at 0x414320
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ecx
push esi
push 2
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
cmp esi, 0x80010106
je 0x414342
test esi, esi
jl 0x41438f
lea eax, [esp + 4]
push eax
push 0x426590
push 1
push 0
push 0x426580
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41438f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0
push 1
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0
push 2
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push 0
push 4
push eax
call edx
mov eax, dword [esp + 4]
test eax, eax
je 0x41439f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
pop esi
jl 0x4143aa
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop ecx
ret

Function at 0x4143b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0041a140
mov eax, dword [esp + 0x68]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x41444e
push ebx
mov bl, byte [esp + 0x64]
test bl, 1
je 0x414417
mov ecx, dword [esp + 8]
push 0x1d4c0
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov esi, eax
neg esi
sbb esi, esi
inc esi
test bl, 2
pop ebx
je 0x41442a
mov edx, dword [esp + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x414441
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, esi
pop esi
add esp, 0x54
ret 0xc
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x54
ret 0xc
Function at 0x4144b0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
push ebp
call fcn.00414470
test eax, eax
jne 0x4144ce
mov eax, 1
pop ebp
add esp, 0x1c
ret 4
push ebx
mov eax, 0xf003f
call fcn.00414460
mov ebx, eax
test ebx, ebx
jne 0x4144f7
push eax
push ebp
push str.Couldnt_open_service_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
xor eax, eax
pop ebp
add esp, 0x1c
ret 4
push esi
push 0x10020
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x41452b
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push ebp
push str.Couldnt_open_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x1c
ret 4
push edi
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
test edi, edi
jne 0x414559
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x414559
mov edi, 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
test edi, edi
pop edi
je 0x414578
pop esi
pop ebx
mov eax, 1
pop ebp
add esp, 0x1c
ret 4
push 0
push ebp
push str.Service_could_not_be_deleted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x1c
ret 4
Function at 0x4146f0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x424
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [esp + 0x428]
mov dword [esp + 0xc], eax
mov byte [eax], 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x414736
mov eax, 1
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00416a72
add esp, 0x424
ret
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push 0x20008
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x414783
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00416a72
add esp, 0x424
ret
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push edi
lea ecx, [esp + 0x24]
push ecx
push 0x400
lea edx, [esp + 0x38]
push edx
mov ebp, 2
push ebp
push eax
call esi
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
mov edi, eax
mov eax, dword [esp + 0x20]
push 0x12
push eax
mov dword [esp + 0x24], ebp
call esi
test eax, eax
jne 0x4147cb
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4147fc
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push ebp
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x414800
xor eax, eax
jmp 0x41484a
xor ebp, ebp
xor esi, esi
cmp dword [esp + 0x30], ebx
jbe 0x414833
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [esp + 0x34]
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
push ecx
push edx
call ebx
test eax, eax
jne 0x41482e
inc esi
add edi, 8
cmp esi, dword [esp + 0x30]
jb 0x414814
jmp 0x414833
mov ebp, 1
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov byte [edx], cl
mov eax, ebp
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00416a72
add esp, 0x424
ret

Function at 0x4148a0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x50
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x4c], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x1a
mov dword [esp + 0x14], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4148dd
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00416a72
add esp, 0x50
ret
lea edx, [esp]
push edx
lea eax, [esp + 0xc]
push eax
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [esp + 0x4c]
neg eax
sbb eax, eax
and eax, dword [esp]
xor ecx, esp
call fcn.00416a72
add esp, 0x50
ret