joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a0eb
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x44a0fb
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov ecx, dword [edi + 4]
xor ecx, dword [edi]
and ecx, 0x7fffffff
xor ecx, dword [edi]
lea edi, [edi + 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebx, 1
jne 0x44a13b
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], ebx
pop esi
pop ebx
ret

Function at 0x44a1ab
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x44a1b4
pop esi
ret

Function at 0x44a211
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x44a228
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x44be12
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
lea edi, [ecx + 4]
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.0044cc96
mov esi, dword [ebp - 0x210]
cmp esi, dword [edi]
je 0x44be9e
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004ab350
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push dword [esi + 0x28]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x20c]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x44be7c
sub edx, esi
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00405500
mov al, 1
jmp 0x44bea0
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 8
Function at 0x44dbd6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x508], 0
lea eax, [ebp - 0x104]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x100
push edi
push ebx
push 0
push eax
or edi, 0xffffffff
call fcn.004ab350
push esi
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00402900
add esp, 0x1c
lea eax, [ebp - 0x508]
xor ebx, ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x104]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44dd03
mov esi, 0x400
lea eax, [ebp - 0x504]
push esi
push ebx
push eax
call fcn.004ab350
add esp, 0xc
mov dword [ebp - 0x510], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x504]
push eax
push ebx
push ebx
push str.PnpInstanceID
push dword [ebp - 0x508]
call esi
test eax, eax
jne 0x44dcf7
push 3
push 0x4e0520
lea eax, [ebp - 0x504]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrIsIntlEqualA]
test eax, eax
je 0x44dcf7
lea eax, [ebp - 0x514]
mov dword [ebp - 0x50c], ebx
push eax
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x514], 4
push eax
push ebx
push ebx
push str.MediaSubType
push dword [ebp - 0x508]
call esi
cmp eax, 2
je 0x44dcf5
test eax, eax
jne 0x44dcf7
cmp dword [ebp - 0x50c], 1
je 0x44dcf5
cmp dword [ebp - 0x50c], 2
jne 0x44dcf7
xor edi, edi
inc edi
jmp 0x44dcf7
mov edi, ebx
push dword [ebp - 0x508]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
Function at 0x44de1a
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x68]
push 0x64
xor ebx, ebx
push ebx
push eax
call fcn.004ab350
add esp, 0xc
mov byte [ebp - 0x70], bl
lea eax, [ebp - 0x74]
mov dword [ebp - 0x6f], ebx
mov byte [ebp - 0x6b], bl
mov dword [ebp - 0x74], ebx
push eax
push ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
push dword [ebp - 0x74]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.0044df21
mov esi, dword [ebp - 0x80]
test esi, esi
je 0x44debb
lea eax, [ebp - 0x74]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x44debb
mov ebx, dword [ebp - 0x70]
lea eax, [esi + 8]
push eax
call fcn.0044dbd6
pop ecx
mov ecx, eax
cmp ecx, 1
je 0x44de9b
test ecx, ecx
jne 0x44deb3
mov ax, word [esi + 0x198]
mov ebx, dword [esi + 0x194]
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x6c], ax
test ecx, ecx
je 0x44debe
mov esi, dword [esi]
test esi, esi
jne 0x44de86
jmp 0x44debe
mov ebx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp - 0x6c]
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr ebx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [ebp - 0x70]
push eax
push str._02X__02X__02X__02X__02X__02X
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.00402900
add esp, 0x24
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.00401c90
lea ecx, [ebp - 0x80]
call fcn.00415390
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret
Function at 0x44f11e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
test eax, eax
jne 0x44f143
mov eax, dword [0x7b1c2c]
mov esi, dword [eax + 4]
jmp 0x44f14c
push eax
call dword [0x7b1c90]
mov esi, eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004ab350
push esi
lea eax, [ebp - 0x20c]
push str.hMod_08x_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret 4

Function at 0x452535
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov bl, byte [edx + 0x100]
mov ch, byte [edx + 0x101]
cmp dword [ebp + 0xc], esi
jle 0x45259b
movzx ecx, ch
movzx eax, bl
mov dword [ebp + 0x10], ecx
push edi
mov ch, byte [ebp + 0x10]
lea ebx, [eax + 1]
movzx eax, bl
mov dword [ebp - 4], eax
mov edi, eax
mov cl, byte [eax + edx]
add ch, cl
movzx eax, ch
mov dword [ebp + 0x10], eax
mov al, byte [eax + edx]
mov byte [edi + edx], al
mov eax, dword [ebp + 0x10]
mov byte [eax + edx], cl
mov al, byte [edi + edx]
mov edi, dword [ebp + 8]
add al, cl
movzx eax, al
mov al, byte [eax + edx]
xor byte [esi + edi], al
inc esi
mov eax, dword [ebp - 4]
cmp esi, dword [ebp + 0xc]
jl 0x45255b
pop edi
pop esi
mov byte [edx + 0x100], bl
mov byte [edx + 0x101], ch
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4526fb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax]
xor edi, edi
call fcn.004526be
push esi
call fcn.004529fd
push dword [ebp + 0xc]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
call fcn.004529fd
push 0x58
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.004ab350
lea eax, [ebp - 0x78]
push eax
push 5
push ebx
call fcn.004525ad
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x20], esi
cmp esi, 5
jb 0x452896
push esi
push ebx
call fcn.00452ae1
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push ebx
call fcn.00452c55
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x452891
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push esi
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x452876
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x452859
xor edx, edx
lea ecx, [edi + 0x2c]
test esi, esi
je 0x4527d7
sub ebx, ecx
mov al, byte [ebx + ecx]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, esi
jb 0x4527c2
mov ebx, dword [ebp - 0x1c]
lea ecx, [edi + 0x2c]
lea eax, [esi + ebx]
push eax
lea eax, [ecx + esi]
push eax
call fcn.0045267a
mov edx, dword [ebp - 0x10]
mov eax, edx
pop ecx
pop ecx
mov ecx, ebx
sub eax, ebx
sub ecx, edx
cmp edx, ebx
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x452825
lea esi, [edi + 0xc]
push esi
call fcn.0045267a
pop ecx
pop ecx
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
push ebx
call fcn.0045267a
mov esi, dword [ebp - 0x20]
jmp 0x45282b
push ebx
call fcn.0045267a
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push esi
push eax
push dword [ebp - 4]
mov dword [edi + 4], esi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
je 0x452885
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x452891
push 1
push edi
call fcn.00452d41
pop ecx
pop ecx
xor edi, edi
call fcn.0045297f
push 0x7b1cec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4528af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
call fcn.004526be
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, dword [esi*4 + 0x7b1d08]
test eax, eax
je 0x4528d7
add eax, 0x2c
cmp eax, dword [ecx]
je 0x452973
inc esi
cmp esi, 0x40
jb 0x4528c1
xor esi, esi
test esi, esi
je 0x452960
push ebx
push dword [esi + 4]
push dword [esi]
call fcn.00452ae1
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 4], edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x45295a
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x452927
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x45291a
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp + 8]
xor edi, edi
mov eax, dword [esi]
inc edi
push 0
push esi
mov dword [ecx], eax
call fcn.00452d41
pop ecx
pop ecx
call fcn.0045297f
pop ebx
push 0x7b1cec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x7b1d08]
jmp 0x4528df

Function at 0x45297f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x7b1e10], esi
jbe 0x4529d1
mov eax, dword [0x7b1e0c]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x7b1e0c]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x7b1e10]
jb 0x4529ac
push dword [0x7b1e0c]
call fcn.004adf87
and dword [0x7b1e0c], 0
and dword [0x7b1e10], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x452a35
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x452acf
test esi, esi
je 0x452acf
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x452ac6
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x452ab2
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x452acf
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x452acf
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x452ac6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x452a80
jmp 0x452acf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret

Function at 0x452c55
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [0x7b1e08], 0x40
jae 0x452d3a
mov ecx, dword [ebp + 8]
mov edx, 0xfff80000
push esi
mov esi, dword [ebp + 0xc]
add esi, ecx
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 4]
cmovb edi, eax
cmp edi, esi
jae 0x452d38
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x452d13
cmp dword [ebp - 0x10], 0x10000
jne 0x452d07
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x452d0a
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x452d0a
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x452d17
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x452cbc
test ebx, ebx
je 0x452d38
xor eax, eax
cmp dword [eax*4 + 0x7b1d08], 0
je 0x452d2b
inc eax
cmp eax, 0x40
jb 0x452d19
jmp 0x452d38
inc dword [0x7b1e08]
mov dword [eax*4 + 0x7b1d08], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456895
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
and dword [ebp - 0x3c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp - 0x4c], cx
lea ecx, [ebp - 0x1c]
push eax
mov dword [ebp - 0x38], 7
call fcn.00403cd0
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
cmovae ecx, dword [ebp - 0x1c]
xor ebx, ebx
push 0x5c
pop edx
inc ebx
cmp word [ecx + eax*2 - 2], dx
je 0x4568f0
push edx
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040d320
push 0x4e107c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004462d4
add esp, 0xc
lea ecx, [ebp - 0x4c]
push eax
call fcn.0040a110
push 0
push ebx
lea ecx, [ebp - 0x34]
call fcn.004053d0
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x2b4]
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4569fb
lea eax, [ebp - 0x2b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4569fb
push 0x2e
pop eax
cmp word [ebp - 0x288], ax
je 0x45693d
cmp word [ebp - 0x286], 0
je 0x45693d
cmp word [ebp - 0x286], ax
jne 0x45697c
cmp word [ebp - 0x284], 0
je 0x45693d
test byte [ebp - 0x2b4], 0x10
lea eax, [ebp - 0x288]
je 0x4569cf
push 0x4fc3dc
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.004462d4
add esp, 0xc
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00440ec3
add esp, 0xc
lea ecx, [ebp - 0x64]
push 0
push ebx
call fcn.004053d0
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push edi
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.00456895
pop ecx
pop ecx
jmp 0x4569eb
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004462d4
add esp, 0xc
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.00409e40
push 0
push ebx
lea ecx, [ebp - 0x34]
call fcn.004053d0
jmp 0x45693d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004053d0
push 0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.004053d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret

Function at 0x457a61
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ecx + 4]
test esi, esi
je 0x457a9f
mov edi, dword [ebp + 0xc]
lea ebx, [edi + 4]
test ebx, ebx
je 0x457a9f
call fcn.00459623
test al, al
je 0x457a9f
mov ecx, edi
call fcn.00459623
test al, al
je 0x457a9f
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x457aa1
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45925f
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
push edi
mov eax, dword [esi]
call dword [eax + 0x14]
test al, al
je 0x45927c
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4e1d2c
push 1
push 0
push 0x4f07f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x4592ed
mov eax, dword [ebp - 4]
lea edx, [ebp + 8]
and dword [ebp + 8], 0
push edx
push 0x4e127c
mov ecx, dword [eax]
push 0x4f07e8
push dword [edi]
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
js 0x4592e0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045840b
add esp, 0x1c
mov esi, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4592ed
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4592fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x45a154
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0045a32f
pop ecx
test al, al
je 0x45a182
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0045a698
add esp, 0xc
test eax, eax
jns 0x45a188
push dword [ebp + 8]
call fcn.0045a628
pop ecx
pop ebp
jmp fcn.0045a0d0
pop ebp
ret

Function at 0x45a36f
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 6
call fcn.0045963d
add esp, 0xc
test al, al
je 0x45a38d
xor eax, eax
jmp 0x45a419
push dword [ebp + 8]
call fcn.0045a18a
pop ecx
test al, al
jne 0x45a386
push edi
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x45a3c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x45a416
push esi
push 2
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x45a3ef
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x45a403
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test esi, esi
je 0x45a40e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a41e
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x7aca10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x45a462
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x45a4ef
push edi
push 0x14
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x45a489
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x45a4dc
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45a4b1
cmp dword [ebp - 0x1c], 4
je 0x45a4dc
cmp dword [ebp - 0x1c], 2
je 0x45a4dc
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x45a4dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x80070420
je 0x45a4dc
mov ebx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x45a4e9
push esi
call edi
push dword [ebp - 0x24]
call edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7ad5
mov esp, ebp
pop ebp
ret