joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x81c]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x81c]
push 1
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x101c]
push 0
push eax
call fcn.004ca680
lea eax, [ebp - 0x1c]
push eax
call fcn.00418a20
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x45d837
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x101c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x45d882
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45d878
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45d89f
push edx
push ecx
call fcn.004a7285
add esp, 8
lea eax, [ebp - 0x101c]
push eax
call fcn.00450000
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
call fcn.004d5d48
int3
Function at 0x45e4c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528f56
mov eax, dword fs:[0]
push eax
mov eax, 0x1264
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x218]
push str.utilshputils.exe
push dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.004672b0
add esp, 4
test eax, eax
je 0x45e6bf
xorps xmm0, xmm0
mov dword [ebp - 0x1270], 0x44
lea eax, [ebp - 0x1270]
movlpd qword [ebp - 0x126c], xmm0
push eax
movlpd qword [ebp - 0x1264], xmm0
movlpd qword [ebp - 0x125c], xmm0
movlpd qword [ebp - 0x1254], xmm0
movlpd qword [ebp - 0x124c], xmm0
movlpd qword [ebp - 0x1244], xmm0
movlpd qword [ebp - 0x123c], xmm0
movlpd qword [ebp - 0x1234], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x1244], 1
push 0x1000
push eax
mov word [ebp - 0x1240], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1218]
push eax
movups xmmword [ebp - 0x122c], xmm0
call fcn.004ca680
add esp, 0xc
call fcn.0040d510
mov ecx, eax
test ecx, ecx
je 0x45e6d9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x121c], eax
push str._UnInstallDesk
lea ecx, [ebp - 0x121c]
mov dword [ebp - 4], 0
call fcn.004115c0
test al, al
jne 0x45e60c
push 0xe
push str._UnInstallDesk
lea ecx, [ebp - 0x121c]
call fcn.00412590
mov esi, dword [ebp - 0x121c]
lea eax, [ebp - 0x218]
push eax
push esi
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 4], 1
push str.__s___s__LockHomePagePath__s___Pidhalowp
push eax
call fcn.0045b280
add esp, 0x14
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x1270]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45e6a0
push 0x1388
push dword [ebp - 0x122c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45e688
push 0x541a48
call fcn.00455860
add esp, 4
push dword [ebp - 0x1228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x122c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45e6bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409d40
int3
Function at 0x45f290
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x45f35d
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x45f347
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x314], 0x73646c
lea eax, [ebp - 0x314]
push edi
push 0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x45f35d
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x318], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.0040a360
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004e7430
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x45f3bd
cmp eax, 0x207
ja 0x45f3bd
jne 0x45f3c4
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f3d0
push 0
lea eax, [ebp - 0x318]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x45f5c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1318
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
mov dword [ebp - 0x1318], eax
lea eax, [ebp - 0x1304]
push 0
push eax
call fcn.004ca680
push 0x800
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.004ca680
add esp, 0x18
lea eax, [ebp - 0x1304]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xfe
lea eax, [ebp - 0x102]
push 0
push eax
call fcn.004ca680
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x1314]
push eax
movups xmmword [ebp - 0x1314], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.004ca680
movzx eax, byte [ebp - 0x1305]
push eax
movzx eax, byte [ebp - 0x1306]
push eax
movzx eax, byte [ebp - 0x1307]
push eax
movzx eax, byte [ebp - 0x1308]
push eax
movzx eax, byte [ebp - 0x1309]
push eax
movzx eax, byte [ebp - 0x130a]
push eax
movzx eax, byte [ebp - 0x130b]
push eax
movzx eax, byte [ebp - 0x130c]
push eax
movzx eax, word [ebp - 0x130e]
push eax
movzx eax, word [ebp - 0x1310]
push eax
push dword [ebp - 0x1314]
lea eax, [ebp - 0x304]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00441e10
lea eax, [ebp - 0x304]
add esp, 0x40
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45f6f0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.004f5036
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1304]
push eax
lea eax, [ebp - 0xb04]
push eax
call edi
push str..tmp
lea eax, [ebp - 0xb04]
push 0x400
push eax
call fcn.004f9945
add esp, 0xc
lea eax, [ebp - 0xb04]
push eax
call ebx
test eax, eax
je 0x45f775
inc esi
cmp esi, 0xa
jl 0x45f642
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xb04]
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45f780
mov ecx, dword [ebp - 0x1318]
lea eax, [ebp - 0xb04]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00412590
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x45f800
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45f85b
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 4]
test esi, esi
je 0x45f92c
mov ecx, dword [edi + 8]
test ecx, ecx
jle 0x45f92c
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [ebp - 0x1010], eax
and ecx, 0x80000fff
jns 0x45f895
dec ecx
or ecx, 0xfffff000
inc ecx
xor edi, edi
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], 0
test eax, eax
jle 0x45f8fa
nop dword [eax + eax]
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004ca100
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45f92c
inc edi
add esi, 0x1000
cmp edi, dword [ebp - 0x1010]
jl 0x45f8b0
mov ecx, dword [ebp - 0x100c]
test ecx, ecx
jle 0x45f92c
push ecx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004ca100
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7695
mov esp, ebp
pop ebp
ret 4
Function at 0x461d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x461d67
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x461d92
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x461d8c
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x461eab
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x461dc9
cmp byte [edi + 0x18], al
je 0x461dbd
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00442950
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x461e02
call fcn.00442950
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.00461ee0
test eax, eax
jns 0x461ea8
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.00461980
mov dword [ebp - 4], eax
test eax, eax
jns 0x461e32
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00461ee0
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x461dd9
push 0
push 0
push ebx
mov ecx, esi
call fcn.00461980
mov edi, eax
test edi, edi
jns 0x461e70
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.00461ee0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x462200
push 0
push 0
call fcn.004f720a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x461dd9
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x461ea8
call fcn.00442950
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4623e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax + 4], 2
jne 0x462431
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0x10], 0
push dword [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46241e
push 0xbb8
lea eax, [ebp + 0x10]
push eax
push 1
push 1
push 1
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00449e00
push dword [ebp + 0x10]
push 1
push str.CPluginTask::RunPlugin_result_d_code_d
call fcn.00455860
add esp, 0xc
pop esi
pop ebp
ret 0xc
Function at 0x462520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
push str.halowp_0961EB1E_4441_4BEB_BC69_7F2F0124241B
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
test edi, edi
je 0x46255b
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
push str.enter_KillProcessesInInstallPath_szTargetDir_s
call fcn.00455860
mov eax, dword [esi]
add esp, 8
mov eax, dword [eax - 0xc]
test eax, eax
je 0x46262b
cmp eax, 4
jle 0x46262b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x210], eax
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.halowp.exe
push dword [esi]
push eax
call edi
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.00449650
add esp, 8
test eax, eax
jne 0x462600
push str.web_helper.exe
push dword [esi]
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.00449650
add esp, 8
test eax, eax
je 0x46260f
call ebx
sub eax, dword [ebp - 0x210]
cmp eax, 0x7530
jbe 0x4625a0
push 0
push dword [esi]
call fcn.004497f0
call fcn.00419860
push str.end_KillProcessesInInstallPath
call fcn.00455860
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret

Function at 0x462a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x57a8c8
mov dword [ebp - 0x68], 0x6e0049
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x740073
push edi
mov dword [ebp - 0x60], 0x6c0061
mov edx, 0x32
mov dword [ebp - 0x5c], 0x44006c
sub esi, eax
mov dword [ebp - 0x58], 0x760072
mov dword [ebp - 0x54], 0x650020
mov dword [ebp - 0x50], 0x720072
mov dword [ebp - 0x4c], 0x72006f
mov dword [ebp - 0x48], 0x25003a
mov dword [ebp - 0x44], 0x2c0064
mov dword [ebp - 0x40], 0x6d0020
mov dword [ebp - 0x3c], 0x73005f
mov dword [ebp - 0x38], 0x720074
mov dword [ebp - 0x34], 0x650053
mov dword [ebp - 0x30], 0x760072
mov dword [ebp - 0x2c], 0x630069
mov dword [ebp - 0x28], 0x4e0065
mov dword [ebp - 0x24], 0x6d0061
mov dword [ebp - 0x20], 0x3d0065
mov dword [ebp - 0x1c], 0x730025
mov dword [ebp - 0x18], 0x20002c
mov dword [ebp - 0x14], 0x610070
mov dword [ebp - 0x10], 0x680074
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
lea ecx, [edx + 0x7fffffcc]
test ecx, ecx
je 0x462b2f
movzx ecx, word [esi + eax]
test cx, cx
je 0x462b2f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x462b11
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x465050
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x465071
mov eax, 0x80004003
pop esi
pop ebp
ret
push ebx
push edi
push 0xf01ff
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x46509b
push esi
mov ebx, 0x80004005
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
neg eax
push edi
sbb ebx, ebx
and ebx, 0x7fffbffb
add ebx, 0x80004005
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x4651c0
Capabilities:
Accept command line arguments
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5297ac
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xf003f
push 0
push 0
mov dword [ebp - 0x118], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x128], edi
mov dword [ebp - 4], 0
test edi, edi
jne 0x465226
mov ebx, 0x80004003
jmp 0x4653cd
push 0xf01ff
push ebx
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x124], ebx
test ebx, ebx
jne 0x46524d
mov ebx, 0x80004005
jmp 0x4653c6
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x114], eax
test esi, esi
jne 0x465279
mov dword [ebp - 0x114], esi
jmp 0x4652ce
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x465280
sub esi, ecx
lea eax, [ebp - 0x110]
push 0x80
push eax
sar esi, 1
lea eax, [ebp - 0x114]
inc esi
push esi
push eax
call fcn.004202f0
lea eax, [esi + esi]
push eax
push dword [ebp - 0x118]
push eax
push dword [ebp - 0x114]
call fcn.00465540
push eax
call fcn.00411520
mov esi, dword [ebp - 0x114]
add esp, 0x24
mov byte [ebp - 4], 2
call fcn.0040d510
mov ecx, eax
test ecx, ecx
je 0x4653eb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x118], eax
push esi
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 3
call fcn.004115c0
test al, al
jne 0x46532c
test esi, esi
jne 0x46530b
xor ecx, ecx
jmp 0x46531f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465310
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x118]
call fcn.00412590
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 1
cmp eax, ecx
je 0x465349
push eax
call fcn.004f54a8
add esp, 4
mov esi, dword [ebp - 0x118]
cmp dword [esi - 0xc], 0
je 0x46536b
lea eax, [ebp - 0x11c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x120], eax
jmp 0x46536d
xor eax, eax
push eax
push dword [ebp - 0x11c]
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x465392
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ebx, 0x80004005
cmp dword [ebp - 0x118], eax
cmovne ebx, eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4653ba
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409d40
int3
Function at 0x465400
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x46543f
pop edi
mov eax, 0x80004003
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push ebx
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x46545a
mov edi, 0x80004005
jmp 0x465491
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 1
push ebx
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
neg eax
push ebx
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x4672b0
Capabilities:
Check if file exists
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x565400
push 0x4cbe00
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x576644]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
test esi, esi
je 0x46742a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46742a
push 0x118
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x548], 0x11c
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x544], 6
jae 0x467343
mov eax, 1
jmp 0x46742c
mov dword [ebp - 0x58c], 0x10
mov dword [ebp - 0x588], esi
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x42c], 0xaac56b
mov dword [ebp - 0x428], 0x11d0cd44
mov dword [ebp - 0x424], 0xc000c28c
mov dword [ebp - 0x420], 0xee95c24f
xor eax, eax
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x570], 2
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x568], 1
mov dword [ebp - 0x560], 1
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], eax
or eax, 0x1080
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], 0
lea eax, [ebp - 0x58c]
mov dword [ebp - 0x564], eax
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
je 0x467448
cmp eax, 0x800b0101
je 0x467448
cmp eax, 0x800b0109
je 0x467448
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x55c]
call sub.WINTRUST.dll_WTHelperProvDataFromStateData
test eax, eax
je 0x4674df
cmp dword [eax + 0x40], 0
jbe 0x4674df
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4674df
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4674df
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4674df
cmp dword [eax + 0xc], 0
jbe 0x4674df
mov eax, dword [ecx]
test eax, eax
je 0x4674df
cmp dword [eax + 0xc], 0
jbe 0x4674df
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4674df
mov eax, dword [eax]
test eax, eax
je 0x4674df
mov esi, dword [eax + 4]
test esi, esi
je 0x4674df
push 0x400
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004ca680
add esp, 0xc
push 0x200
lea eax, [ebp - 0x41c]
push eax
push 0
push 0
push 4
push esi
call dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
dec eax
mov ecx, 1
cmp eax, 0x1fe
cmovbe edi, ecx
mov dword [ebp - 0x54c], edi
mov esi, dword [ebp - 0x55c]
push 0x30
push 0
lea eax, [ebp - 0x57c]
push eax
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x57c], 0x30
mov dword [ebp - 0x55c], esi
mov dword [ebp - 0x560], 2
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
call sub.WINTRUST.dll_WinVerifyTrust
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
jmp 0x46742c