joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4037d2
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0xf0000000
push 0x18
push 0x466304
push 0x466304
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403820
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40387b
mov dword [ebp - 0xc], esp
push 0
push 0x18
push 0x466304
push 0x466304
lea eax, [ebp - 4]
push eax
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403864
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40387b
mov eax, 0x466391
jmp 0x4038ea
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00403902
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4038a0
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4038cb
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4038e5
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004327e2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4038ea
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4038fb
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x404def
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00434230
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x404e34
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x404e4b
mov eax, 0x466304
push eax
push 1
mov ebx, 0x130
call fcn.00433d30
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x404e87
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404eb5
mov eax, dword [ebp - 4]
test eax, eax
je 0x404eb0
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.004327e2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x404ebf
mov eax, 0x466304
jmp 0x404ebf
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x404ed0
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x40526e
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x1c
call fcn.004327e2
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push SysReAllocString
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4052d7
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40539f
mov dword [ebp - 0x14], esp
push SysReAllocString
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x405310
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40537d
mov dword [ebp - 0x14], esp
push dword [ebp - 0xc]
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x405342
push 6
call fcn.004327d6
add esp, 4
test eax, eax
je 0x40535b
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40537d
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40539f
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4053a7
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40590f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x40592a
call fcn.0040599a
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x405956
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405980
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x405994
mov esp, ebp
pop ebp
ret 8
Function at 0x405c8c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405cd8
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405eaa
mov dword [ebp - 0x10], esp
push 0xf01ff
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405d11
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405e88
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0xffffffff
push 0xffffffff
push 0xffffffff
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x405e0d
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x405e20
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x405e30
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x405e40
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405e50
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x405e60
push ebx
call fcn.004327ee
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405e88
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405eaa
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x405eb2
mov esp, ebp
pop ebp
ret 8
Function at 0x405eb8
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405f04
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405fbd
mov dword [ebp - 0x10], esp
push 0x10
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405f3d
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405f9b
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405f76
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405f9b
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x405fbd
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x405fc5
mov esp, ebp
pop ebp
ret 4
Function at 0x405fcb
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x28], 0
mov eax, 0
sete al
test eax, eax
je 0x406000
mov eax, 0x10
jmp 0x406003
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x24], eax
cmp dword [ebp + 0x30], 0
mov eax, 0
sete al
test eax, eax
je 0x406024
mov eax, 3
jmp 0x406027
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
mov dword [ebp - 0xc], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406058
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406185
cmp dword [ebp + 0x1c], 0
je 0x40609a
push 0x80000301
push 0
push 0x100
push 0x80000301
push 0
push dword [ebp + 0x24]
push 2
mov ebx, 0xc8
call fcn.00433b90
add esp, 0x1c
mov dword [ebp + 0x24], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x44]
push dword [ebx]
mov ebx, dword [ebp + 0x3c]
push dword [ebx]
mov ebx, dword [ebp + 0x34]
push dword [ebx]
push 0
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 1
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push 0xf01ff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x406113
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x406126
push ebx
call fcn.004327ee
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406141
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040619c
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406163
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406185
push 6
call fcn.004327d6
add esp, 4
cmp dword [ebp - 8], 0
mov eax, 0
setne al
jmp 0x406196
mov esp, ebp
pop ebp
ret 0x44
Function at 0x40619c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0x20000000
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4061ef
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4062d8
mov dword [ebp - 0x14], esp
push 2
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406228
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4062b6
mov dword [ebp - 0x14], esp
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyn]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406263
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x406291
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4062b6
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4062d8
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x4062e0
mov esp, ebp
pop ebp
ret 8
Function at 0x40b100
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0x1c
call fcn.004327e2
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], esp
push 1
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b169
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b220
mov dword [ebp - 0x14], esp
push 0x20
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b1a2
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x40b1fe
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
push 1
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b1d9
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b1fe
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40b220
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x40b228
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x414ddc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x414e19
push 6
call fcn.004327d6
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x414e24
mov esp, ebp
pop ebp
ret 4

Function at 0x414e2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x414e65
push 6
call fcn.004327d6
add esp, 4
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x1bc
call fcn.00433b60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414e98
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x414ebc
add eax, 8
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x414edc
push 6
call fcn.004327d6
add esp, 4
push 0x80000301
push 0
push dword [ebp - 8]
push reloc.WSOCK32.dll_getpeername
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x414ef9
mov eax, 0x466391
push eax
push 2
mov ebx, 0x1a0
call fcn.00433da0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414f23
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x414f41
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004327e2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x414f46
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414f57
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41868f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x28
call fcn.004327e2
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
nop
nop
cmp dword [ebp - 8], esp
je 0x4186d7
push 6
call fcn.004327d6
add esp, 4
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
jmp 0x4186ea
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004327ee
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x419444
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419490
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419576
push 0x80000301
push 0
push 0x10000
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 3
mov ebx, 0xc8
call fcn.00433b90
add esp, 0x28
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x419500
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x419554
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41952f
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419554
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419576
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x41957e
mov esp, ebp
pop ebp
ret 4
Function at 0x42e8ea
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42e936
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42eb35
mov dword [ebp - 0x10], esp
push 0xf01ff
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42e96f
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42eb13
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x20], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00434270
add esp, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esp
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0xffffffff
push dword [ebp + 0xc]
push 0xffffffff
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x42ea88
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42ea9b
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x42eaab
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42eabb
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42eacb
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x42eadb
push ebx
call fcn.004327ee
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x42eaeb
push ebx
call fcn.004327ee
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42eb13
push 6
call fcn.004327d6
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x42eb35
push 6
call fcn.004327d6
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x42eb3d
mov esp, ebp
pop ebp
ret 8