joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b7d0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x938
push ebx
push ebp
push esi
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0x128]
xor ebp, ebp
push eax
push ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [esp + 0x330]
push 0x104
push edx
push 0xffffffffffffffff
push 0x4563c0
push ebp
push ebp
call edi
mov esi, dword [esp + 0x950]
cmp esi, ebp
je 0x41b8a5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41b8a5
cmp byte [esi], 0x2e
je 0x41b8a5
lea eax, [esp + 0x740]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push ebp
push ebp
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x740]
lea edx, [esp + 0x538]
push ecx
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x538]
push 0x44f028
push eax
call edi
lea ecx, [esp + 0x128]
lea edx, [esp + 0x538]
push ecx
push edx
call edi
lea eax, [esp + 0x538]
lea ecx, [esp + 0x128]
push eax
push ecx
call esi
mov ebx, dword [esp + 0x94c]
mov eax, dword [ebx + 0x5660]
cmp eax, ebp
je 0x41b9e9
cmp dword [ebx + 0x5670], ebp
je 0x41b9e9
cmp dword [ebx + 0x565c], ebp
je 0x41b9db
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push 0xffffffffffffffff
push edx
push 1
lea ecx, [esp + 0x13c]
push ebp
push ecx
push ebp
call eax
mov esi, eax
cmp esi, ebp
je 0x41b8ff
cmp esi, 0xea
jne 0x41b93f
mov eax, dword [esp + 0x14]
xor edi, edi
cmp eax, ebp
jbe 0x41b93f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x330]
push edx
mov ecx, dword [eax + edi*4]
push ecx
call ebx
test eax, eax
je 0x41b930
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jb 0x41b90f
jmp 0x41b938
mov dword [esp + 0x18], 1
mov ebx, dword [esp + 0x94c]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
cmp esi, ebp
je 0x41b97b
cmp esi, 0xea
je 0x41b97b
lea edx, [esp + 0x330]
lea eax, [esp + 0x128]
push edx
push eax
lea ecx, [esp + 0x2c]
push 0x44ef98
push ecx
call edi
lea edx, [esp + 0x34]
push esi
push edx
call fcn.004243e0
add esp, 0x18
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
je 0x41b994
mov eax, dword [ebx + 0x565c]
cmp eax, ebp
je 0x41b994
push ecx
call eax
mov dword [esp + 0x10], ebp
mov ebx, dword [esp + 0x18]
cmp ebx, ebp
jne 0x41b9ce
cmp esi, ebp
jne 0x41b9ce
lea eax, [esp + 0x330]
lea ecx, [esp + 0x128]
push eax
push ecx
lea edx, [esp + 0x2c]
push 0x44ef60
push edx
call edi
lea eax, [esp + 0x34]
push 0x529
push eax
call fcn.004243e0
add esp, 0x18
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x938
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44ef00
jmp 0x41b9f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44ee98
call fcn.004243e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x938
ret
Function at 0x41d430
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push edi
push 0
push 0
push 0
push 0xa5
call esi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push eax
push 0xa5
call edi
push 0
push 0
push 0
push 0xd
call esi
push eax
push 0xd
call edi
push 0
push 2
push 0
push 0xd
call esi
push eax
push 0xd
call edi
push 0
push 2
push 0
push 0xa5
call esi
push eax
push 0xa5
call edi
pop edi
pop esi
ret
Function at 0x41dd50
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
mov edi, ecx
push eax
push 0
push edi
push 0x421ae0
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41dd78
pop edi
pop esi
pop ecx
ret
push 2
push 0
add edi, 0x18
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x41dda6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x41ddc0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
mov edi, ecx
push eax
push 0
push edi
push 0x421850
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41dde8
pop edi
pop esi
pop ecx
ret
push 2
push 0
add edi, 0x30
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x41de16
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x41de30
Capabilities:
Create thread

Disassembly:
sub esp, 0x84
push ebx
push esi
push edi
mov edi, ecx
call fcn.00423a50
test eax, eax
je 0x41df6f
call fcn.004237a0
test eax, eax
je 0x41df6f
push 0x44505c
lea eax, [esp + 0x1c]
push 0x78
lea ecx, [esp + 0x14]
xor ebx, ebx
push eax
push ecx
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x6d
mov byte [esp + 0x1e], 0x70
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x28], bl
call fcn.00427a00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0x10
lea edx, [esp + 0x18]
push 0x44505c
push edx
call esi
test eax, eax
je 0x41dec4
pop edi
mov dword [0x457464], ebx
mov dword [0x457468], ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x84
ret
push 0x44505c
lea eax, [esp + 0x1c]
push 0x78
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x1f], 0x46
mov byte [esp + 0x20], 0x54
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
call fcn.00427a00
add esp, 0x10
lea edx, [esp + 0x18]
push 0x44505c
push edx
call esi
lea eax, [esp + 0x14]
mov dword [0x457464], 1
push eax
push ebx
push edi
push 0x427ae0
push ebx
push ebx
mov dword [0x457468], 1
call fcn.00430a8e
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x41df37
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret
push 2
push ebx
add edi, 0x3c
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x41df69
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x84
ret
Function at 0x41df80
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push edi
mov edi, ecx
push eax
push 0
push edi
push 0x426fc0
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41dfa8
pop edi
pop esi
pop ecx
ret
push 2
push 0
add edi, 0x44
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x41dfd6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x41dff0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 4
push ecx
push 0x421f70
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41e014
pop esi
pop ecx
ret
push 0xfffffffffffffff1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x41e040
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 4
push ecx
push 0x421d20
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41e064
pop esi
pop ecx
ret
push 0xfffffffffffffff1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x41e4b0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0xc74]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
push eax
push 4
push edi
push 0x41bdf0
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x41e4f0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
add edi, 0x1c
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x41e52f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4208e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x11c
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 0xc74]
push edi
push ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xc5c]
mov esi, dword [eax]
cmp esi, eax
je 0x420a92
mov edi, dword [esi + 8]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
test eax, eax
je 0x420939
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
test eax, eax
je 0x420939
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x7c]
test eax, eax
jne 0x42094a
mov esi, dword [esi]
mov eax, dword [ebx + 0xc5c]
cmp esi, eax
jne 0x420915
jmp 0x420a92
mov ecx, edi
call fcn.0040e9b0
mov ecx, edi
call fcn.0040e770
mov ecx, dword [esp + 0x130]
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
cmp ax, 0xffff
jne 0x42098f
mov ecx, edi
call fcn.0040e900
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret 4
test ax, ax
jbe 0x420a59
and eax, 0xffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0x24]
push 0x106
push edx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
test eax, eax
jbe 0x420a3d
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0042fffb
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x420a3d
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [edi + 0x563c]
push 0xc
mov ebx, dword [esi + 4]
call fcn.0042fffb
add esp, 4
mov ecx, esi
test esi, esi
jne 0x420a0c
mov ecx, eax
test ebx, ebx
mov dword [eax], ecx
jne 0x420a14
mov ebx, eax
mov dword [eax + 4], ebx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x420a28
mov dword [eax], ebp
mov eax, dword [edi + 0x5640]
mov dword [esp + 0x10], 1
inc eax
mov dword [edi + 0x5640], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x4209a9
mov ebp, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0
push edi
push 0x424670
push 0
push 0
call fcn.00430a8e
add esp, 0x18
test eax, eax
jne 0x420a7c
mov dword [esp + 0x10], eax
jmp 0x420a8b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x420a92
mov ecx, edi
call fcn.0040e900
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4
Function at 0x422210
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x110
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0x80
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x422255
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x422255
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
je 0x4222d1
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4222d1
xor ebx, ebx
movsx ecx, word [ebp + 0xa]
mov esi, dword [ebx + eax]
mov edx, ecx
lea edi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0xa4]
push 0x44ffe0
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x130]
add esp, 0xc
lea edx, [esp + 0xa0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x422245
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
jne 0x422270
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret

Function at 0x423a10
Capabilities:
Create thread

Disassembly:
push ecx
call fcn.004237a0
test eax, eax
je 0x423a41
lea eax, [esp]
push eax
push 0
push 0
push 0x422120
push 0
push 0
call fcn.00430a8e
add esp, 0x18
test eax, eax
jne 0x423a3a
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret

Function at 0x423b10
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x45aae8]
sub esp, 0x10
dec eax
mov dword [0x45ac14], 1
push esi
push edi
je 0x423b75
dec eax
jne 0x423b9a
lea eax, [esp + 8]
mov dword [esp + 8], 0x44e53c
push eax
mov dword [esp + 0x10], 0x423bd0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x423b9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x450d5c
call fcn.004243e0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
push 0x450d4c
call fcn.00427d30
mov edi, eax
add esp, 4
test edi, edi
je 0x423b9a
push 0x450d34
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x423ba2
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
push 1
push 0
call esi
push 0
call fcn.00419ec0
add esp, 4
push 0
push 0
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x423cb0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0
push 0
push 0x423d30
push 0
push 0
call fcn.00430a8e
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x423ceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x450dc4
call fcn.004243e0
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x45aaf0
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
pop edi
test eax, eax
push esi
jne 0x423d1b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x424090
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x45aae8]
sub esp, 0x20
dec eax
push ebp
push esi
je 0x424214
dec eax
jne 0x4242b6
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x4241f1
push 0xf01ff
push 0x44e53c
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4241c7
lea eax, [esp + 0xc]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x424147
lea ecx, [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ecx
push esi
call edi
test eax, eax
je 0x424122
cmp dword [esp + 0x18], 3
jne 0x424122
push 0xbb8
call ebx
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x424108
mov eax, dword [esp + 0x18]
pop edi
cmp eax, 1
je 0x424147
push 0x2710
push 0x30
push 0x44e3b4
push 0x451104
push 0
call fcn.00429040
add esp, 0x14
push 0x3e8
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
pop ebx
jne 0x42419c
push 0x2710
push 0x30
push 0x44e3b4
push 0x4510d4
push eax
call fcn.00429040
push 0
push 0
push 0x44e3b4
push 0x66
push 1
call fcn.00424500
add esp, 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0
push 0
push 0x44e3b4
push 0x65
push 4
call fcn.00424500
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0x2710
push 0x30
push 0x44e3b4
push 0x4510a8
push 0
call fcn.00429040
add esp, 0x14
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0x2710
push 0x30
push 0x44e3b4
push 0x451000
push 0
call fcn.00429040
add esp, 0x14
xor eax, eax
pop esi
pop ebp
add esp, 0x20
ret
call fcn.00423af0
test eax, eax
jne 0x424237
push 0x2710
push 0x30
push 0x44e3b4
push 0x450fd0
push eax
call fcn.00429040
add esp, 0x14
lea eax, [esp + 8]
push eax
push 0x450e54
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x424273
push 0x2710
push 0x30
push 0x44e3b4
push 0x450f8c
push 0
call fcn.00429040
add esp, 0x14
xor eax, eax
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 8]
push 0x44e53c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4242af
mov edx, dword [esp + 8]
push edx
call esi
push 0x2710
push 0x30
push 0x44e3b4
push 0x4510d4
push 0
call fcn.00429040
add esp, 0x14
mov eax, dword [esp + 8]
push eax
call esi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x424500
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x10
push esi
push edi
call fcn.00423790
test eax, eax
jne 0x42457f
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x42451b
mov eax, 0x456160
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
xor edi, edi
lea eax, [esp + 8]
mov ecx, 3
cmp dword [eax], 0
je 0x424540
inc edi
add eax, 4
dec ecx
jne 0x42453a
push 0x44e53c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x42457f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push 0
push edx
push 0
push edi
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x424590
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x210
call fcn.00423790
test eax, eax
jne 0x42465b
lea eax, [esp + 0x10c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x42465b
lea ecx, [esp + 8]
push 0x450e8c
push ecx
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push 0x44e53c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
lea ecx, [esp + 8]
push eax
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42465b
lea edx, [esp + 0x10c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 4]
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [esp + 0x114]
push eax
push 2
push 0
push 0x45119c
push ecx
call esi
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push 0x45118c
push eax
mov dword [esp + 0x20], 0x1f
call esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x210
ret
Function at 0x425581
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 1
mov eax, dword [esi + 0xa10]
test eax, eax
jl 0x42559d
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 0xa10], eax
jge 0x4255b9
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x4255da
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0xa10]
lea edx, [esp + 8]
push 4
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ecx
ret

Function at 0x425640
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xa10]
test eax, eax
jge 0x42565b
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4256aa
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x425651
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x4256a4
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [edi + 0xa10]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x10
ret 8

Function at 0x425da0
Capabilities:
Initialize winsock library

Disassembly:
push esi
push 0x45ac18
mov esi, ecx
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov eax, esi
pop esi
ret

Function at 0x425e20
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 1
mov eax, dword [esi + 4]
test eax, eax
jl 0x425e39
call fcn.00425e90
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 4], eax
jge 0x425e52
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x425e73
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push 4
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ecx
ret