joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e73c
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call sub.ntdll.dll__chkstk
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x1004]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43e777
mov eax, dword [ebp - 0x100c]
jmp 0x43e7df
mov edx, dword [ebp - 0x1004]
shr edx, 2
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x1008], 0
jmp 0x43e7a1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1010]
jae 0x43e7d9
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1000]
push ecx
call fcn.0043e355
add esp, 8
mov edx, dword [ebp - 0x100c]
add edx, eax
mov dword [ebp - 0x100c], edx
jmp 0x43e792
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret

Function at 0x43e7e3
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call sub.ntdll.dll__chkstk
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x1004]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43e81e
mov eax, dword [ebp - 0x100c]
jmp 0x43e886
mov edx, dword [ebp - 0x1004]
shr edx, 2
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x1008], 0
jmp 0x43e848
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1010]
jae 0x43e880
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1000]
push ecx
call fcn.0043e57d
add esp, 8
mov edx, dword [ebp - 0x100c]
add edx, eax
mov dword [ebp - 0x100c], edx
jmp 0x43e839
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret

Function at 0x43ee07
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x4b203c
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
call fcn.0043f5ed
test eax, eax
jne 0x43ee3f
mov dword [ebp - 4], 1
jmp 0x43ee65
mov ecx, dword [ebp - 0xc]
call fcn.00440108
test eax, eax
jne 0x43ee5f
push str.___breg_InitEngine__failed___
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 2
jmp 0x43ee65
xor edx, edx
test edx, edx
jne 0x43ee2a
mov ecx, dword [ebp - 0xc]
call fcn.004400d5
cmp dword [ebp - 4], 0
je 0x43ee87
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x4ba708
lea ecx, [ebp - 8]
push ecx
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x43ee8e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x4b203c
mov ecx, dword [ebp - 8]
call fcn.0044013c
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x40], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x48], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x50], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x54], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
je 0x43ef86
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x43efbb
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004aa2c8
add esp, 4
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x43efbf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push edi
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x18], 0
je 0x43f015
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x43f015
or eax, 0xffffffff
jmp 0x43f18e
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x124]
call fcn.0043f434
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43f041
jmp 0x43f166
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x124]
call fcn.0043f45b
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x124]
call fcn.0043f54d
cmp dword [ebp - 4], 0
jne 0x43f15c
cmp dword [ebp - 8], 0
je 0x43f15c
mov eax, dword [ebp + 0x14]
cmp dword [eax], 2
jne 0x43f146
push 0x5137b8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43f146
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
push 0x5137bc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43f146
mov byte [ebp - 0x118], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
push 0x104
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x5137c0
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x18]
push eax
call fcn.0040a230
add esp, 0x18
jmp 0x43f166
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
xor edx, edx
test edx, edx
jne 0x43f015
cmp dword [ebp - 8], 0
je 0x43f18b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.004aa2c8
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x43f5ed
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5137c8
push 0
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrRStrIA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x43f654
xor eax, eax
jmp 0x43f7ad
push 0x5137cc
call fcn.0042d849
add esp, 4
test eax, eax
jne 0x43f6d2
push 0x5137dc
lea edx, [ebp - 0x104]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, 0x104
sub ecx, eax
push ecx
mov edx, dword [ebp - 0x108]
add edx, 1
push edx
call fcn.00409100
push 1
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.0043fa03
test eax, eax
jne 0x43f6af
xor eax, eax
jmp 0x43f7ad
push 3
push 1
push 1
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0043fff3
test eax, eax
jne 0x43f6d2
xor eax, eax
jmp 0x43f7ad
push 0x5137e8
lea edx, [ebp - 0x104]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, 0x104
sub ecx, eax
push ecx
mov edx, dword [ebp - 0x108]
add edx, 1
push edx
call fcn.00409100
push 2
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.0043fa03
test eax, eax
jne 0x43f727
push str.___bregdll.dll_write_resource_failed___
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x43f7ad
lea ecx, [ebp - 0x104]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
add edx, 1
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x110]
mov dword [eax + 8], ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x10c]
add eax, 1
push eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 8]
push edx
call fcn.00409100
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.0043fd23
test eax, eax
jne 0x43f7a8
push str.___bregdll.dll_get_function_pointers_failed___
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x43f7ad
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43f7b2
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x43f7e2
mov eax, 1
jmp 0x43f89a
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov edx, 1
test edx, edx
je 0x43f845
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x51384c
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.00403f10
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call fcn.0043f89e
add esp, 4
test eax, eax
je 0x43f845
jmp 0x43f7f7
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43f884
xor eax, eax
jmp 0x43f89a
push 4
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x43f89e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [ebp + 8], 0
je 0x43f8bd
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x43f8c1
xor eax, eax
jmp 0x43f939
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x43f8d3
xor eax, eax
jmp 0x43f939
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x43f8fb
mov eax, dword [ebp - 8]
and eax, 0x10
test eax, eax
je 0x43f8f4
xor eax, eax
jmp 0x43f939
mov eax, 1
jmp 0x43f939
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43f919
xor eax, eax
jmp 0x43f939
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x148]
and ecx, 0x10
test ecx, ecx
je 0x43f934
xor eax, eax
jmp 0x43f939
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43fff3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x513a24
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.0040a230
add esp, 0x10
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x513a2c
lea edx, [ebp - 0x108]
push edx
call fcn.0042d389
add esp, 0x14
test eax, eax
jne 0x440069
mov eax, dword [ebp - 4]
jmp 0x4400ce
call fcn.0042d020
test eax, eax
je 0x440085
push 0x513a34
call fcn.0042d048
add esp, 4
test eax, eax
jne 0x440085
jmp 0x4400cb
push 0x513a3c
call fcn.0042d592
add esp, 4
test eax, eax
jne 0x4400b4
call fcn.0042d50d
test eax, eax
jne 0x4400a1
jmp 0x4400cb
push 0x513a44
call fcn.0042d592
add esp, 4
test eax, eax
jne 0x4400b4
jmp 0x4400cb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 1
xor ecx, ecx
test ecx, ecx
jne 0x440069
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4419ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0x80
push 2
push 0
push 2
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x441a31
xor eax, eax
jmp 0x441a73
push 0
lea ecx, [ebp - 4]
push ecx
push 0x7388
push 0x515494
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x441a5d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x441a73
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x441ade
Capabilities:
Check if file exists
Create service
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00441a79
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x441b4a
cmp dword [ebp - 4], 0
je 0x441b4a
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x441b4a
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x441b5a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x441bd8
Capabilities:
Delete file
Get common file path
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp - 0x128]
cmp dword [eax + 0x1c], 0xffffffff
je 0x441bfd
mov eax, 1
jmp 0x441d9a
push 0x514504
call fcn.00441b63
add esp, 4
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x128]
cmp dword [edx + 0x1c], 0xffffffff
je 0x441c3a
mov eax, dword [ebp - 0x128]
mov dword [eax + 0x18], 1
mov ecx, dword [ebp - 0x128]
mov eax, dword [ecx + 0x18]
jmp 0x441d9a
mov edx, dword [ebp - 0x128]
cmp dword [edx + 0x18], 0
je 0x441c50
mov eax, 1
jmp 0x441d9a
mov eax, dword [ebp - 0x128]
cmp dword [eax + 0x1c], 0xffffffff
je 0x441c66
mov eax, 1
jmp 0x441d9a
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers360FkAdv.sys
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x128]
call fcn.004419ff
test eax, eax
jne 0x441ca7
xor eax, eax
jmp 0x441d9a
lea ecx, [ebp - 0x104]
push ecx
push 0x51452c
mov ecx, dword [ebp - 0x128]
call fcn.00441ade
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x441d24
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x441cee
cmp dword [ebp - 0x120], 4
je 0x441d0a
push 0
push 0
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edx, dword [ebp - 0x128]
mov dword [edx + 0x18], eax
jmp 0x441d17
mov eax, dword [ebp - 0x128]
mov dword [eax + 0x18], 1
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x514538
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
mov eax, dword [ebp - 0x128]
cmp dword [eax + 0x18], 0
je 0x441d91
push 0x514564
call fcn.00441b63
add esp, 4
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x128]
cmp dword [edx + 0x1c], 0xffffffff
je 0x441d84
mov eax, dword [ebp - 0x128]
mov dword [eax + 0x18], 1
jmp 0x441d91
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x128]
mov eax, dword [edx + 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x441e07
Capabilities:
Manipulate safe mode programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 8]
push eax
push 0x514574
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441e44
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
push 7
push 0x5145b4
push 1
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f486
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441e81
mov eax, dword [ebp - 8]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
lea edx, [ebp - 8]
push edx
push 0x5145bc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441ec5
mov eax, dword [ebp - 8]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
push 7
push 0x5145f8
push 1
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f486
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441f02
mov edx, dword [ebp - 8]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
mov eax, dword [ebp - 8]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
lea ecx, [ebp - 8]
push ecx
push 0x514600
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441f46
mov edx, dword [ebp - 8]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
push 7
push 0x514640
push 1
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f486
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441f83
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
mov edx, dword [ebp - 8]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
lea eax, [ebp - 8]
push eax
push 0x514648
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441fc4
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
push 7
push 0x514684
push 1
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f486
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441ffe
mov eax, dword [ebp - 8]
push eax
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
xor eax, eax
jmp 0x442013
mov ecx, dword [ebp - 8]
push ecx
call fcn.0043ed70
mov ecx, eax
call fcn.0043f54d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x442474
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x44248e
mov ecx, dword [ebp - 8]
call fcn.00441d9e
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0
jne 0x44249b
xor eax, eax
jmp 0x44250c
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x24], 0x64
jl 0x4424b7
xor eax, eax
jmp 0x44250c
push 0x5148ec
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x222010
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4424fc
xor eax, eax
jmp 0x44250c
push str._CSpecialModuleKiller::ProtectRegKey___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x442512
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x44252c
mov ecx, dword [ebp - 8]
call fcn.00441d9e
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0
jne 0x442539
xor eax, eax
jmp 0x44257e
push 0x514944
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 4
lea eax, [ebp + 8]
push eax
push 0x222014
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x44256e
xor eax, eax
jmp 0x44257e
push str._CSpecialModuleKiller::ProtectByPassPid___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4426b9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 0
jne 0x4426d3
mov ecx, dword [ebp - 0x14]
call fcn.00441d9e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x18], 0
jne 0x4426e0
xor eax, eax
jmp 0x442737
push 0x514a6c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 4]
push edx
push 8
lea eax, [ebp - 0x10]
push eax
push 0x222020
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x442723
xor eax, eax
jmp 0x442737
push str._CSpecialModuleKiller::DelRegValueKey___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret 8