joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c600
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b076
mov eax, dword fs:[0]
push eax
sub esp, 0x534
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x627970]
test eax, eax
je 0x40c7df
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x540], 0x11c
push ecx
call eax
cmp dword [ebp - 0x530], 2
jne 0x40c7df
cmp dword [ebp - 0x53c], 5
jb 0x40c7df
push 0x40c
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 0x22
push 0
push eax
call fcn.005557a0
add esp, 0xc
lea eax, [ebp - 0x41e]
push 0x207
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___service
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.00553bbd
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x40c756
call fcn.0043c5a7
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40c6ec
push 0x80004005
call fcn.00420690
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
lea eax, [edi + 0x234]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x424]
push 0x5e9f74
push eax
call fcn.0041fa60
mov esi, dword [ebp - 0x424]
add esp, 0xc
push 0
push 0
push esi
call fcn.00444a00
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c74f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x40c7f5
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x420]
push eax
push 1
push 2
push 0x110
push 0xf01ff
lea eax, [edi + 0x34]
push eax
lea ebx, [edi + 0x234]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
push esi
test edi, edi
jne 0x40c7cd
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.0043c5a7
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40c7b0
push 0x80004005
call fcn.00420690
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 1
push ebx
jmp 0x40c70a
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, 1
jmp 0x40c7f5
push 0
push ecx
lea eax, [edi + 0x234]
mov ecx, esp
push eax
call fcn.0041f920
call fcn.0040d6f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
Function at 0x40c820
Capabilities:
Delete service
Print debug messages
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x627970]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x40c9b4
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x11c
push ecx
call eax
cmp dword [ebp - 0x12c], 2
jne 0x40c9b4
cmp dword [ebp - 0x138], 5
jb 0x40c9b4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x140], ebx
test ebx, ebx
je 0x40c996
push 0xf01ff
lea eax, [esi + 0x234]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40c975
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40c922
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call edi
test eax, eax
je 0x40c8fa
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
mov eax, dword [ebp - 0x1c]
cmp eax, 3
jne 0x40c8fd
push 0x3e8
call ebx
lea eax, [ebp - 0x20]
push eax
push esi
call edi
test eax, eax
jne 0x40c8e0
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x40c916
push 0x30
push 0x5e9f98
push 0x5e9fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0x140]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40c951
push 0x5e9fb0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call edi
push ebx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
push 0x5e9fc0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call edi
push ebx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
push 0x5e9fd0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
push 0x5e9fe0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
push 1
push ecx
lea eax, [esi + 0x234]
mov ecx, esp
push eax
call fcn.0041f920
call fcn.0040d6f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00550cb3
mov esp, ebp
pop ebp
ret
Function at 0x40d130
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov eax, edx
push esi
lea esi, [eax + 2]
jmp 0x40d150
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d150
sub eax, esi
sar eax, 1
pop esi
cmp eax, 0x1f4
jae 0x40d191
push edx
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x5ea080
push 0x200
push eax
call fcn.00553249
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4

Function at 0x40d6f0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x420]
mov esi, 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d733
xor esi, esi
jmp 0x40d836
mov edi, dword [ebp + 0xc]
cmp edi, 1
je 0x40d81b
mov eax, 0x22
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___service
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00553bbd
add esp, 0xc
test edi, edi
jne 0x40d7b1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d785
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40d82a
push 0x104
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005557a0
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], esi
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00552352
add esp, 8
test eax, eax
je 0x40d82a
xor esi, esi
jmp 0x40d82a
push dword [ebp + 8]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40d853
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 8
Function at 0x40d940
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
push esi
lea esi, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x40d960
sub edx, esi
pop esi
cmp edx, 0x1f4
jae 0x40d997
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push str.STATUS_d_ErrMsg_s
push eax
call fcn.0041a6a0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4

Function at 0x40d9b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 3
ja case.default.0x40d9d2
jmp dword [eax*4 + 0x40db08]
mov ecx, dword [0x627900]
lea eax, [ecx + 0x18]
mov dword [ecx + 0x24], 0
push eax
push dword [ecx + 0x34]
mov dword [ecx + 0x1c], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x40da29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x627900]
cmp dword [ecx + 0x10], 0
je 0x40da29
push eax
mov ecx, str.Stop_SetServiceStatus_error_n
call fcn.0040d940
mov eax, dword [0x627900]
cmp dword [eax + 0x10], 0
je 0x40daf5
push 0
mov ecx, str.Service_Stop_n
call fcn.0040d940
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x627900]
mov dword [ecx + 0x1c], 7
jmp 0x40daab
mov ecx, dword [0x627900]
mov dword [ecx + 0x1c], 4
jmp 0x40daab
mov ecx, dword [0x627900]
cmp dword [ecx + 0x10], 0
je 0x40daab
push str.Unrecognized_opcode_n
push edx
lea eax, [ebp - 0x204]
push str.STATUS_d_ErrMsg_s
push eax
call fcn.0041a6a0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x627900]
lea eax, [ecx + 0x18]
push eax
push dword [ecx + 0x34]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x40daf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x627900]
cmp dword [ecx + 0x10], 0
je 0x40daf5
push str.SetServiceStatus_error_n
push eax
lea eax, [ebp - 0x204]
push str.STATUS_d_ErrMsg_s
push eax
call fcn.0041a6a0
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4
Function at 0x40db20
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x420]
mov esi, 1
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40db62
xor esi, esi
jmp 0x40dc82
cmp dword [ebp + 0x68], esi
je 0x40dc5e
mov eax, 0x22
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___service
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00553bbd
add esp, 0xc
cmp dword [ebp + 0x68], 0
jne 0x40dbeb
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dbb3
sub ecx, edx
lea eax, [ebp + 8]
sar ecx, 1
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40dc76
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0x208
push 0
push eax
mov dword [ebp - 0x418], esi
call fcn.005557a0
add esp, 0xc
lea ecx, [ebp - 0x41c]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x418]
push ecx
push 0
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00552352
add esp, 8
test eax, eax
je 0x40dc76
xor esi, esi
jmp 0x40dc76
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.00402150
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 0x64
Function at 0x40e8a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40e91a
cmp esi, 0xffffffff
je 0x40e91a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
jne 0x40e908
mov dword [ebp - 0x14], 0x5eaa00
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x14]
push eax
push edi
push str._tasp::library_TerminateProcess__dwPID:_lu__err_lu._n
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], 0
cmp eax, 0x57
jne 0x40e965
push eax
push edi
push str._tasp::library_KillProcessOfID__dwPID:_lu__err_lu._n
sub esp, 0xc
mov dword [ebp - 0x14], 0x5ea928
movq xmm0, qword [ebp - 0x14]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
push edi
push str._tasp::library_KillProcessOfID__dwPID:_lu__err_lu._n
sub esp, 0xc
mov dword [ebp - 0x14], 0x5ea978
movq xmm0, qword [ebp - 0x14]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
test esi, esi
je 0x40efaf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
test edi, edi
jne 0x40efa0
mov dword [esp + 8], 0x5eade8
mov dword [esp + 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [esp + 8]
push eax
push str._tasp::library_TerminateProcess_err:_lu
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esp + 8], 0x5eae68
mov dword [esp + 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [esp + 8]
push eax
push str._tasp::library_OpenProcess_err:_lu
sub esp, 0xc
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], 3
call fcn.00404820
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push ecx
push eax
mov dword [ebp - 0xc], 0
call fcn.0040f160
mov esi, eax
test esi, esi
je 0x40f13d
push 0x44
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.005557a0
add esp, 0xc
mov dword [ebp - 0x64], 0x44
mov eax, 1
mov dword [ebp - 0x5c], str.WinSta0Default
mov word [ebp - 0x34], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push esi
push 0x8000420
push 0
push 0
push 0
push edi
push 0
push dword [ebp - 0xc]
movdqu xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
mov dword [ebp - 0x70], 2
test ebx, ebx
je 0x40f0ec
push str._tasp::library_CreateProcessAsUser_sucess_n
sub esp, 0xc
mov dword [ebp - 0x74], 0x5eaf08
movq xmm0, qword [ebp - 0x74]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 1
call fcn.00404820
add esp, 0x10
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0xc]
call edi
push esi
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0x74], 0x5eaf88
call dword [sym.imp.KERNEL32.dll_GetLastError]
movq xmm0, qword [ebp - 0x74]
push eax
push str._tasp::library_CreateProcessAsUser_error_d_n
sub esp, 0xc
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x14
push dword [ebp - 0xc]
call edi
push esi
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40f350
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b3b2
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.00555880
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x1038], edi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1024], eax
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1028], 1
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
mov ecx, dword [ebp - 0x1014]
xor esi, esi
test ecx, ecx
je 0x40f4ed
mov ebx, dword [ebp - 0x1024]
mov edx, dword [ebp + 0xc]
lea eax, [ebx + 4]
cmp dword [eax], edx
je 0x40f408
inc esi
add eax, 0x10
cmp esi, ecx
jb 0x40f3f7
jmp 0x40f4f3
push 0x800
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x101c], 0x3ff
push 0
push eax
mov dword [ebp - 0x1018], 0x3ff
call fcn.005557a0
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.005557a0
add esp, 0x18
lea eax, [ebp - 0x1020]
add esi, esi
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebx + esi*8 + 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp word [ebp - 0x810], 0
jne 0x40f484
xor ecx, ecx
jmp 0x40f49f
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f490
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, edi
push eax
call fcn.0041f200
cmp dword [edi + 0x10], 0
jne 0x40f4ed
push str._tasp::library_WTSEnumerateProcessesW_AccountNameNULL._n
sub esp, 0xc
mov dword [ebp - 0x1034], 0x5eb348
mov eax, esp
mov dword [ebp - 0x1030], 2
movq xmm0, qword [ebp - 0x1034]
movq qword [eax], xmm0
mov dword [eax + 8], 3
call fcn.00404820
add esp, 0x10
mov ebx, dword [ebp - 0x1024]
test ebx, ebx
je 0x40f4fe
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 8
Function at 0x4101d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b57b
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x618190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
push 0x6c
mov dword [ebp - 4], 0
call fcn.0043b7fd
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x410222
mov ecx, eax
call fcn.004102f0
mov esi, eax
jmp 0x410224
xor esi, esi
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp + 0x18]
cmp dword [ebp + 0x2c], 0x10
push ecx
cmovae eax, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00412ed0
mov edx, eax
mov byte [ebp - 4], 2
lea eax, [esi + 8]
cmp dword [edx + 0x14], 8
jb 0x41025a
mov edx, dword [edx]
cmp word [edx], 0
jne 0x410264
xor ecx, ecx
jmp 0x410282
mov ecx, edx
lea ebx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410270
sub ecx, ebx
lea eax, [esi + 8]
sar ecx, 1
push ecx
push edx
mov ecx, eax
call fcn.0041f200
lea ecx, [ebp - 0x70]
call fcn.00402150
mov eax, dword [ebp + 0x10]
push 0
push 0
push esi
push 0x410110
push 0
push 0
mov dword [esi + 0x68], eax
call fcn.00553ffb
add esp, 0x18
mov esi, eax
test edi, edi
je 0x4102b9
mov dword [edi], esi
jmp 0x4102c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test esi, esi
setne bl
cmp dword [ebp + 0x2c], 0x10
jb 0x4102d8
push dword [ebp + 0x18]
call fcn.0043b833
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4133c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], 0
call fcn.005557a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._system32_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00553bbd
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004021f0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4
Function at 0x413d50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bf21
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x618190]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xd4]
push 0x5ed1d4
call fcn.004021f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
mov eax, dword [ebp - 0xc4]
push esi
mov dword [ebp - 0x138], eax
call fcn.00402340
mov byte [ebp - 4], 1
mov ebx, 1
xor edi, edi
jmp 0x413dc0
cmp dword [ebp - 0xc0], 8
lea edx, [ebp - 0xd4]
cmovae edx, dword [ebp - 0xd4]
cmp word [edx], 0
jne 0x413dde
xor eax, eax
jmp 0x413df2
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413de3
sub eax, esi
sar eax, 1
push eax
push edi
push edx
lea ecx, [ebp - 0x134]
call fcn.00416420
mov esi, eax
lea ecx, [ebp - 0x134]
cmp esi, 0xffffffff
je 0x413ebb
push esi
push 0
lea eax, [ebp - 0x150]
push eax
call fcn.00414700
xor ecx, ecx
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], cx
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x5c], cl
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x44], cx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 6
cmp ecx, eax
je 0x413e71
push 0xffffffffffffffff
push 0
push eax
call fcn.0041ee90
mov byte [ebp - 4], 1
cmp dword [ebp - 0x13c], 8
jb 0x413e8c
push dword [ebp - 0x150]
call fcn.0043b833
add esp, 4
mov edi, dword [ebp - 0x138]
lea eax, [ebp - 0x74]
add edi, esi
cmp dword [ebp - 0x60], 8
push 0
cmovae eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
lea ecx, [ebp - 0x74]
sbb eax, eax
and ebx, eax
call fcn.00402150
jmp 0x413dc0
call fcn.00402150
lea ecx, [ebp - 0xd4]
call fcn.00402150
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00550cb3
mov esp, ebp
pop ebp
ret 4