joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409460
Capabilities:
Copy file
Set file attributes

Disassembly:
push edi
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x80
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, edi
pop edi
ret

Function at 0x409480
Capabilities:
Create process on windows
Get token membership
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0xa18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xa14]
push ecx
mov dword [ebp - 0xa1c], ebx
mov dword [ebp - 0xa18], ebx
mov dword [ebp - 0xa14], ebx
mov word [ebp - 0xa10], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4094f1
mov eax, dword [ebp - 0xa18]
lea edx, [ebp - 0xa1c]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4094f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0xa18]
cmp eax, ebx
je 0x409508
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0xa1c], ebx
jne 0x4095e3
push 0x206
lea edx, [ebp - 0x20a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x20c], cx
call fcn.00422210
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fe
lea edx, [ebp - 0xa0a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xa0c], cx
call fcn.00422210
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xa0c]
push str.Elevate_Run:__s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x38
lea edx, [ebp - 0xa54]
push ebx
push edx
mov dword [ebp - 0xa58], 0x3c
call fcn.00422210
add esp, 0x28
lea ecx, [ebp - 0xa0c]
lea eax, [ebp - 0x20c]
push ecx
mov dword [ebp - 0xa4c], str.runas
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0xa44], esi
mov dword [ebp - 0xa50], ebx
mov dword [ebp - 0xa3c], 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea edx, [ebp - 0xa58]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 1
call fcn.0041c62e
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x409a00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x7fe
xor edi, edi
lea ecx, [ebp - 0xa06]
xor eax, eax
push edi
push ecx
mov word [ebp - 0xa08], ax
call fcn.00422210
add esp, 0xc
push 0x1fe
lea eax, [ebp - 0x206]
xor edx, edx
push edi
push eax
mov dword [ebp - 0xa0c], 0x100
mov word [ebp - 0x208], dx
call fcn.00422210
add esp, 0xc
lea ecx, [ebp - 0xa0c]
push ecx
lea edx, [ebp - 0x208]
push edx
push esi
call fcn.00402b60
add esp, 0xc
test eax, eax
je 0x409aaa
lea eax, [ebp - 0x208]
push 9
push eax
call fcn.0041bed8
add esp, 8
cmp eax, edi
je 0x409aaa
lea edx, [ebp - 0x208]
xor ecx, ecx
push 0x435550
push edx
mov word [eax], cx
call fcn.0041a8a7
add esp, 8
test eax, eax
je 0x409ae1
push esi
lea eax, [ebp - 0xa08]
push 0x435568
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xa08]
add esp, 0xc
push ecx
call fcn.00403790
add esp, 4
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00409920
test eax, eax
jne 0x409b23
push esi
lea edx, [ebp - 0xa08]
push 0x435598
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa08]
push eax
call fcn.00403790
add esp, 4
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
push 0x38
lea ecx, [ebp - 0xa44]
push edi
push ecx
call fcn.00422210
add esp, 0xc
lea edx, [ebp - 0xa48]
push edx
mov dword [ebp - 0xa48], 0x3c
mov dword [ebp - 0xa44], 0x40
mov dword [ebp - 0xa40], edi
mov dword [ebp - 0xa3c], edi
mov dword [ebp - 0xa38], esi
mov dword [ebp - 0xa34], 0x4301b4
mov dword [ebp - 0xa30], 0xb5a1c0
mov dword [ebp - 0xa2c], edi
mov dword [ebp - 0xa28], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push 0x4301b4
push esi
lea eax, [ebp - 0xa08]
push 0x4355c8
push eax
call ebx
lea ecx, [ebp - 0xa08]
push ecx
call fcn.00403790
mov edx, dword [ebp - 0xa10]
add esp, 0x14
push 0x927c0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test edi, edi
je 0x409c0b
cmp edi, 0x102
je 0x409bf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
lea eax, [ebp - 0xa08]
push 0x435648
push eax
call ebx
add esp, 0x14
lea ecx, [ebp - 0xa08]
push ecx
jmp 0x409b09
push esi
lea edx, [ebp - 0xa08]
push 0x435600
push edx
call ebx
jmp 0x409aff
push esi
lea ecx, [ebp - 0xa08]
push 0x4355e4
push ecx
call ebx
lea edx, [ebp - 0xa08]
add esp, 0xc
push edx
call fcn.00403790
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40a220
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x7fe
push eax
lea ecx, [ebp - 0x816]
push ecx
mov dword [ebp - 0x820], esi
mov word [ebp - 0x818], ax
call fcn.00422210
add esp, 0xc
push esi
push 0
push 0x42fc18
push str.ComputerNameList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x81c], edi
mov word [ebp - 0x14], dx
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
cmp edi, 1
jge 0x40a2a2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
push 0x4400
push 0
push 0xb49fc0
call fcn.00422210
add esp, 0xc
mov dword [0xb49fc0], edi
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x4301b4]
mov word [eax + 0xb49fc4], cx
add eax, 2
test cx, cx
jne 0x40a2c0
mov ebx, 1
cmp edi, ebx
jl 0x40a376
mov esi, 0xb4a004
push 0xa
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [esi], ebx
call fcn.0041aee5
mov ecx, dword [ebp - 0x820]
add esp, 0xc
push ecx
push 0x20
lea eax, [esi + 4]
push eax
push 0x4301b4
lea edx, [ebp - 0x14]
push edx
push str.ComputerNameList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [0xb57ce0], 0
je 0x40a36a
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0x818]
rep stosd dword es:[edi], eax
lea eax, [esi + 4]
push eax
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x818]
push str._Debug__GetPcList___u__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x818]
push edx
call fcn.00403790
mov edi, dword [ebp - 0x81c]
add esp, 0x14
inc ebx
add esi, 0x44
cmp ebx, edi
jle 0x40a2e8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40adb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00422210
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x40ae18
xor eax, eax
movzx ecx, word [ebp + eax - 0x44]
mov word [eax + 0xb5bbf8], cx
add eax, 2
test cx, cx
jne 0x40adf1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40bb10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00422210
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xb5a1c0
lea edx, [ebp - 0x210]
push str._sPCScript.dat
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40bba9
lea edx, [ebp - 0x210]
push edx
push 0x436258
push 0xb5b3f8
call esi
add esp, 0xc
push 0xb5b3f8
call fcn.00403790
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x458]
push eax
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x474]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPCScriptUpdateInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x480], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40bc29
push 0x4362bc
push 0xb5b3f8
call esi
push 0xb5b3f8
call fcn.00403790
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x474]
push 8
lea edx, [ebp - 0x47c]
push edx
push 3
push 0
push str.ForceUpdateTime
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x474]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x488]
push edx
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x216]
movzx edx, word [ebp - 0x218]
push eax
movzx eax, word [ebp - 0x21a]
push ecx
movzx ecx, word [ebp - 0x21e]
push edx
movzx edx, word [ebp - 0x220]
push eax
push ecx
push edx
push 0x436300
push 0xb5b3f8
call esi
push 0xb5b3f8
call fcn.00403790
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40c740
Capabilities:
Delete directory

Disassembly:
push ecx
push 0
push 0
push str.C:UsersPublicSMR7WM7installTemp
call fcn.00404730
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
pop ecx
ret
Function at 0x40cf20
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xb59150]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1a
push 0x402
push eax
call edi
call fcn.00411f40
test eax, eax
jne 0x40cf66
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov ecx, dword [0xb59150]
push 0
push 0x1e
push 0x402
push ecx
call edi
push 0
call fcn.004122d0
mov edx, dword [0xb59150]
add esp, 4
push 0
push 0x1f
push 0x402
push edx
call edi
push str._Terminate_All_Process_.
call fcn.00403790
add esp, 4
call fcn.00413560
test al, al
je 0x40cf53
mov eax, dword [0xb59150]
push 0
push 0x2d
push 0x402
push eax
call edi
call fcn.00401550
test eax, eax
jne 0x40cfe8
call fcn.004022d0
test eax, eax
jne 0x40cfe8
call fcn.004023d0
test eax, eax
jne 0x40cfe8
push str._Terminate_Driver_.
call fcn.00403790
add esp, 4
call fcn.00412790
cmp dword [0xb568b0], 1
jne 0x40d013
push 0x436b14
call fcn.00403790
add esp, 4
call fcn.00413b60
call fcn.004015d0
test eax, eax
je 0x40d062
call fcn.00414240
jmp 0x40d062
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x40d062
push 0xf01ff
push str.wm7f
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40d05b
lea ecx, [ebp - 0x20]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [0xb59150]
push 0
push 0x31
push 0x402
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40d090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.00426160
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push str.C:UsersPublicSMR7WM7installTemp
call fcn.0041ad6e
add esp, 8
cmp eax, 0xffffffff
jne 0x40d0d1
mov ecx, str.C:UsersPublicSMR7WM7installTemp
call fcn.004042f0
test eax, eax
je 0x40d232
push 0x7fe
lea ecx, [ebp - 0x806]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x808], ax
call fcn.00422210
add esp, 0xc
push 0x7fe
lea eax, [ebp - 0x1006]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1008], dx
call fcn.00422210
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
push str.C:UsersPublicSMR7WM7ClientPackage.cab
lea ecx, [ebp - 0x1008]
push str.__s__f:__s
push ecx
call esi
push 0x38
lea edx, [ebp - 0x1040]
push ebx
push edx
call fcn.00422210
add esp, 0x1c
lea ecx, [ebp - 0x1044]
lea eax, [ebp - 0x1008]
push ecx
mov dword [ebp - 0x1044], 0x3c
mov dword [ebp - 0x1040], 0x40
mov dword [ebp - 0x103c], ebx
mov dword [ebp - 0x1038], ebx
mov dword [ebp - 0x1034], str.expand.exe
mov dword [ebp - 0x1030], eax
mov dword [ebp - 0x102c], 0xb59388
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x1024], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0x808]
push 0x436b88
push eax
call esi
lea ecx, [ebp - 0x808]
add esp, 0xc
push ecx
call fcn.00403790
mov edx, dword [ebp - 0x100c]
add esp, 4
push 0x927c0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, ebx
je 0x40d245
cmp edi, 0x102
je 0x40d215
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x808]
push 0x436bd8
push eax
call esi
lea ecx, [ebp - 0x808]
push ecx
call fcn.00403790
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x808]
push 0x436bb4
push edx
call esi
lea eax, [ebp - 0x808]
push eax
call fcn.00403790
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x808]
push 0x436ba0
push ecx
call esi
lea edx, [ebp - 0x808]
push edx
call fcn.00403790
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x40df00
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x20c], 0
mov word [ebp - 0x204], ax
call fcn.00422210
lea edx, [ebp - 0x204]
push str.SystemCurrentControlSetServicesWin_Win7
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40dfef
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x208]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40dfc0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x208]
push edx
push 0xf003f
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40dfef
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x40e000
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x411b70
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
push 0x1fe
lea ecx, [ebp - 0x206]
xor eax, eax
push edi
push ecx
xor bl, bl
mov dword [ebp - 0x60c], edi
mov dword [ebp - 0x614], edi
mov word [ebp - 0x208], ax
call fcn.00422210
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x606]
xor edx, edx
push edi
push eax
mov word [ebp - 0x608], dx
call fcn.00422210
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea ecx, [ebp - 0x208]
push str.SystemCurrentControlSetServices_s
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x60c]
push edx
push 0x2001f
push 0
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411c98
push esi
lea ecx, [ebp - 0x608]
push 0x439fcc
push ecx
call edi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.00403790
add esp, 4
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x411c96
push esi
lea eax, [ebp - 0x608]
push 0x43a000
push eax
call edi
lea ecx, [ebp - 0x608]
add esp, 0xc
push ecx
call fcn.00403790
add esp, 4
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov bl, 1
mov eax, dword [ebp - 0x60c]
push 4
lea edx, [ebp - 0x610]
push edx
push 4
push 0
push str.TestValue
push eax
mov dword [ebp - 0x610], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x411d05
push eax
lea ecx, [ebp - 0x608]
push 0x43a050
push ecx
call edi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.00403790
mov eax, dword [ebp - 0x60c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x60c]
push str.TestValue
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
lea edx, [ebp - 0x608]
push 0x43a098
push edx
call edi
lea eax, [ebp - 0x608]
add esp, 0xc
push eax
call fcn.00403790
mov ecx, dword [ebp - 0x60c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x411d7c
lea edx, [ebp - 0x60c]
push edx
push 0xf003f
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411d7c
mov ecx, dword [ebp - 0x60c]
lea eax, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x411da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x206]
push ecx
mov word [ebp - 0x208], ax
call fcn.00422210
add esp, 0xc
mov dword [ebp - 0x60c], 0
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SystemCurrentControlSetServicesWin_Win]
mov word [ebp + eax - 0x208], cx
add eax, 2
test cx, cx
jne 0x411de0
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411e4a
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x411e2c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x43a0e0
call fcn.00403790
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x406]
push edx
mov word [ebp - 0x408], cx
call fcn.00422210
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x606]
push ecx
mov dword [ebp - 0x610], 1
mov word [ebp - 0x608], ax
call fcn.00422210
add esp, 0xc
mov dword [ebp - 0x614], 0x200
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x42f9d8]
mov word [ebp + eax - 0x408], cx
add eax, 2
test cx, cx
jne 0x411ea0
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x608]
push eax
mov eax, dword [ebp - 0x60c]
lea ecx, [ebp - 0x610]
push ecx
push 0
lea edx, [ebp - 0x408]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x411ef5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x411f17
push 0x43a110
call fcn.00403790
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
push 0x43a144
call fcn.00403790
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x413a80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x228
lea ecx, [ebp - 0x22c]
push 0
push ecx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], 0x22c
call fcn.00422210
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea edx, [ebp - 0x230]
mov esi, eax
push edx
push esi
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x413b45
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041a8a7
add esp, 8
test eax, eax
jne 0x413b32
mov edx, dword [ebp - 0x228]
push edx
push eax
push 1
call ebx
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x413af0
pop ebx
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
Function at 0x413ff0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x41405d
push 0xf01ff
push str.wm7f
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x41405a
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.PbkE
call fcn.00403790
add esp, 4
push esi
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret