joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c9f6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x18c], 0xffffffff
mov word [ebp - 0x178], 0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x188], 0
push 0
push 0xa7
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xffffffff
jne 0x41ca7e
jmp 0x41cbce
push 0
lea ecx, [ebp - 0x174]
push ecx
push 0x170
lea edx, [ebp - 0x170]
push edx
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x41cab4
jmp 0x41cbcc
cmp dword [ebp - 0x174], 0x170
je 0x41cac5
jmp 0x41cbca
mov ecx, dword [ebp - 0x11c]
shr ecx, 8
and ecx, 0xff
mov word [ebp - 0x178], cx
mov edx, dword [ebp - 0x11c]
and edx, 0xffff0000
mov eax, dword [ebp - 0x178]
and eax, 0xffff
add edx, eax
mov dword [ebp - 0x184], edx
mov ecx, dword [ebp - 0x11c]
and ecx, 0xff
mov word [ebp - 0x178], cx
mov edx, dword [ebp - 0x178]
and edx, 0xffff
shl edx, 0x10
mov dword [ebp - 0x180], edx
movsx eax, byte [ebp - 0x121]
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
shl ecx, 8
mov dword [ebp - 0x188], ecx
movsx edx, byte [ebp - 0x122]
mov eax, dword [ebp - 0x188]
or eax, edx
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
and ecx, 0xff
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x190], 1
cmp dword [ebp + 0xc], 0
je 0x41cb80
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x184]
mov dword [edx], eax
cmp dword [ebp + 0x10], 0
je 0x41cb91
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x180]
mov dword [ecx], edx
cmp dword [ebp + 0x14], 0
je 0x41cba2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x188]
mov dword [eax], ecx
cmp dword [ebp - 0x18c], 0xffffffff
je 0x41cbc2
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18c], 0xffffffff
mov eax, dword [ebp - 0x190]
jmp 0x41cbd0
jmp 0x41cb6f
jmp 0x41cb6f
jmp 0x41cb6f
mov esp, ebp
pop ebp
ret
Function at 0x41cbd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
mov eax, dword [str.KAV00000.UPD]
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x437f80]
mov dword [ebp - 0x108], ecx
mov edx, dword [0x437f84]
mov dword [ebp - 0x104], edx
mov al, byte [0x437f88]
mov byte [ebp - 0x100], al
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x114]
push ecx
push 6
mov edx, dword [ebp + 8]
push edx
call fcn.0041ff4d
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x104]
sub edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00405071
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x41cc88
mov eax, dword [ebp - 8]
and eax, 0x10
test eax, eax
je 0x41cc8c
xor eax, eax
jmp 0x41cc91
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41d6f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x41d70c
jmp 0x41d74a
cmp dword [ebp + 8], 0
jne 0x41d714
jmp 0x41d748
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d73a
jmp 0x41d746
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41d74c
jmp 0x41d741
jmp 0x41d741
jmp 0x41d741
mov esp, ebp
pop ebp
ret 8

Function at 0x41d752
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x41d76d
jmp 0x41d7c3
cmp dword [ebp + 8], 0
jne 0x41d775
jmp 0x41d7c1
cmp dword [ebp + 0xc], 0
jne 0x41d77d
jmp 0x41d7bf
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d7b1
jmp 0x41d7bd
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41d7c5
jmp 0x41d7b8
jmp 0x41d7b8
jmp 0x41d7b8
jmp 0x41d7b8
mov esp, ebp
pop ebp
ret 8

Function at 0x41d7cb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x41d7e6
jmp 0x41d836
cmp dword [ebp + 8], 0
jne 0x41d7ee
jmp 0x41d834
cmp dword [ebp + 0xc], 0
je 0x41d7fa
cmp dword [ebp + 0x10], 0
jae 0x41d7fc
jmp 0x41d832
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d824
jmp 0x41d830
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41d838
jmp 0x41d82b
jmp 0x41d82b
jmp 0x41d82b
jmp 0x41d82b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d83e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
jne 0x41d860
jmp 0x41d8aa
cmp dword [ebp + 8], 0
jne 0x41d868
jmp 0x41d8a8
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d892
jmp 0x41d8a6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
jmp 0x41d8ac
jmp 0x41d8a1
jmp 0x41d8a1
jmp 0x41d8a1
mov esp, ebp
pop ebp
ret 8
Function at 0x41d8b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], 0
mov dword [ebp - 8], 0xc8
mov eax, dword [ebp - 0xdc]
cmp dword [eax + 4], 0
jne 0x41d8e0
jmp 0x41d94c
cmp dword [ebp + 8], 0
jne 0x41d8e8
jmp 0x41d94a
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x41d91e
jmp 0x41d948
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov dword [ebp - 0xd8], 1
mov eax, dword [ebp - 0xd8]
jmp 0x41d94e
jmp 0x41d940
jmp 0x41d940
jmp 0x41d940
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d9b9
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x41d9d4
jmp 0x41da08
cmp dword [ebp + 8], 0
jne 0x41d9dc
jmp 0x41da06
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d9f8
jmp 0x41da04
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41da0a
jmp 0x41d9ff
jmp 0x41d9ff
jmp 0x41d9ff
mov esp, ebp
pop ebp
ret 4

Function at 0x41dab8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
add eax, 4
push eax
push 0x10
mov ecx, dword [ebp + 8]
push ecx
push 0x4380ac
push str.Scan_Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41db4b
push 0x10
push 0
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xf
mov edx, dword [ebp + 8]
mov dword [edx + 8], 2
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 2
sub esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, esp
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 8]
call fcn.0041da8e
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x41e04e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 4
push ecx
push 0x10
mov edx, dword [ebp + 8]
push edx
push 0x438294
push str.Watch_Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e09d
jmp 0x41e11c
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x41e117
push 0x10
push 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 2
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 2
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, esp
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0xc]
call fcn.0041dfd2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41e117
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41e11e
jmp 0x41e0a4
mov esp, ebp
pop ebp
ret 4

Function at 0x41e124
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
push 0x4382ac
call fcn.00405071
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x41e1a7
jmp 0x41e24e
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x439d24
push 0x4382b8
push 0x4382bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x41e1dc
jmp 0x41e24c
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x439d28
push 0x4382c8
push 0x4382d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x41e215
jmp 0x41e24a
push 0x4382e0
lea eax, [ebp - 0x20c]
push eax
push 0x438304
push 0x43830c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
jmp 0x41e250
jmp 0x41e242
jmp 0x41e238
jmp 0x41e242
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x41e86f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
push 0x30
mov ecx, dword [ebp + 8]
push ecx
push 0x4384f8
push 0x438500
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e939
push 0x30
push 0
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0xb4
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x12c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 3
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 2
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], 0x6e
mov edx, dword [ebp + 8]
mov dword [edx + 0x2c], 0x19
sub esp, 0x30
mov ecx, 0xc
mov esi, dword [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
call fcn.0041e825
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e95b
jmp 0x41e967
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x41e969
jmp 0x41e962
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f07e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 8], 0
jne 0x41f0c6
jmp 0x41f169
lea eax, [ebp - 0x104]
push eax
push 0x104
push 0x4386f0
call fcn.00405071
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x41f0f0
jmp 0x41f167
lea ecx, [ebp - 0x104]
push ecx
push 0x28
mov edx, dword [ebp + 8]
add edx, 4
push edx
push 0x439d3c
push 0x4386fc
push 0x438708
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x41f126
jmp 0x41f165
lea eax, [ebp - 0x104]
push eax
push 0x7d1
push 0x438744
push 0x438750
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x41f151
jmp 0x41f163
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x10c]
jmp 0x41f16b
jmp 0x41f15b
jmp 0x41f15b
jmp 0x41f15b
jmp 0x41f15b
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x421ea9
Capabilities:
Print debug messages
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push edi
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 4], 0
mov al, byte [0x439d5c]
mov byte [ebp - 0x204], al
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x421f27
push 0x438bd8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4220be
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x421f74
mov eax, dword [ebp + 8]
push eax
push str.OpenService__s__failed_n
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4220bc
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x421fa7
push 0x438c08
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4220ba
cmp dword [ebp - 0x224], 1
jne 0x421fb5
jmp 0x4220b8
lea edx, [ebp - 0x228]
push edx
push 1
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
push ecx
push str.ControlService_____d_n
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x42202d
push str.QueryServiceStatus___failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4220b6
cmp dword [ebp - 0x224], 3
je 0x422038
jmp 0x422060
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x22c]
add eax, 0xc8
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x9c40
jl 0x421ffa
cmp dword [ebp - 0x224], 1
je 0x42206b
jmp 0x4220b4
mov dword [ebp - 0x230], 1
cmp dword [ebp - 0x20c], 0
je 0x422095
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x20c], 0
cmp dword [ebp - 4], 0
je 0x4220ac
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x230]
jmp 0x4220c0
jmp 0x422075
jmp 0x422075
jmp 0x42206b
jmp 0x422075
jmp 0x422075
jmp 0x422075
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4220c5
Capabilities:
Delete registry key
Delete service
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x110], 0
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x38
xor eax, eax
lea edi, [ebp - 0xe9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42213f
push 0x438c84
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42228d
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x422166
jmp 0x422288
mov edx, dword [ebp + 8]
push edx
call fcn.00421ea9
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4221c3
mov al, byte [0x439d60]
mov byte [ebp - 0x314], al
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push str.KMGStopServiceEx__s__failed_n
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x422283
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4221e9
push str.DeleteService___failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x42227e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x114], 1
push 0x104
push 0
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x103
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
lea edx, [ebp - 0x10c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x110], 0
je 0x42225f
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x110], 0
cmp dword [ebp - 8], 0
je 0x422276
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x114]
jmp 0x422292
jmp 0x4221fe
jmp 0x4221fe
jmp 0x4221f4
jmp 0x4221fe
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422298
Capabilities:
Create service
Persist via windows service
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4222df
push str.OpenSCManager___failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4223ba
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x422300
jmp 0x4223b8
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 1
push 2
push pe_nt_image_headers32
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42237c
mov al, byte [0x439d64]
mov byte [ebp - 0x20c], al
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
push str.CreateService__s__failed_n
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4223b6
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x42239a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4223b1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
jmp 0x4223bc
jmp 0x422383
jmp 0x42237c
jmp 0x422383
pop edi
mov esp, ebp
pop ebp
ret