joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401366
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x455a40
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.Item.0
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x14], ecx
mov edx, 0x844320
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x36], cl
mov byte [eax + 0x37], 1
mov dword [eax + 0x38], edx
mov edx, dword [0x9798bc]
mov dword [eax + 0x3c], 4
push esi
mov esi, dword fs:[0x2c]
mov edx, dword [esi + edx*4]
mov byte [eax + 0x30], cl
mov byte [eax + 0x34], cl
mov byte [eax + 0x35], cl
mov byte [eax + 0x33], cl
mov byte [eax + 0x32], cl
mov byte [eax + 0x31], cl
mov dword [eax + 0x28], ecx
mov byte [eax + 0x40], cl
mov dword [eax + 0x44], 0xffffffff
mov edx, dword [edx + 0x108]
mov esi, dword [edx + 0x10]
mov dword [eax + 0x24], esi
mov dword [edx + 0x10], eax
mov edx, dword [edx + 0x2c]
mov esi, dword [edx + 0x4a0]
cmp esi, ecx
je 0x455ae3
mov esi, dword [esi + 0x144]
cmp esi, 2
je 0x455ad7
cmp esi, 1
jne 0x455ae3
mov edx, dword [edx + 0x4a0]
inc dword [edx + 0x134]
pop esi
ret
Function at 0x403738
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4aee40
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
mov ecx, 9
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
cmp eax, 0x7f6
mov dword [esp + 0xc], 0
ja 0x4af054
cmp eax, 0x7b1
jb 0x4af054
cmp eax, 0x7f6
mov edx, dword [esp + 0x14]
jne 0x4aee99
cmp edx, 1
ja 0x4af054
mov ecx, dword [esp + 0x18]
cmp ecx, 0x13
ja 0x4af054
jmp 0x4aee9d
mov ecx, dword [esp + 0x18]
cmp eax, 0x7b1
jne 0x4aeeb6
cmp edx, 0xc
jb 0x4af054
cmp ecx, 0x1f
jb 0x4af054
cmp eax, 0x7f6
jne 0x4aeed6
cmp edx, 1
jne 0x4aeed6
cmp ecx, 4
jbe 0x4aeed6
sub ecx, 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], 2
push ebx
push ebp
push ecx
push edx
push eax
call fcn.0040bbea
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
lea eax, [eax + eax*2]
lea ecx, [ebp + eax*8]
mov eax, dword [0x972e50]
imul ecx, ecx, 0x3c
add ecx, ebx
imul ecx, ecx, 0x3c
add ecx, eax
mov dword [esp + 0x1c], eax
lea edx, [ecx + edi - 0x79748a10]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x78], edx
call fcn.005e25d0
add esp, 0x14
xor esi, esi
mov ecx, dword [esp + 0x44]
cmp ebp, ecx
mov edx, dword [esp + 0x3c]
jne 0x4aef3b
cmp ebx, dword [esp + 0x40]
jne 0x4aef3b
cmp edi, edx
je 0x4aefac
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x48]
cmp eax, 0xffffffff
jge 0x4aef4f
mov eax, 1
jmp 0x4aef57
cmp eax, 1
jle 0x4aef57
or eax, 0xffffffff
lea eax, [eax + eax*2]
shl eax, 3
sub eax, ecx
mov ecx, dword [esp + 0x40]
add eax, ebp
imul eax, eax, 0x3c
sub eax, ecx
add eax, ebx
imul eax, eax, 0x3c
sub eax, edx
mov edx, dword [esp + 0x10]
add eax, edi
lea ecx, [edx + eax + 0xe10]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x64]
add ecx, eax
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], ecx
call fcn.005e25d0
add esp, 8
inc esi
cmp esi, 2
jb 0x4aef25
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
cmp esi, 2
jne 0x4af02c
cmp ebp, ecx
je 0x4af02c
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x48]
cmp eax, 0xffffffff
jge 0x4aefc9
mov eax, 1
jmp 0x4aefd1
cmp eax, 1
jle 0x4aefd1
or eax, 0xffffffff
lea eax, [eax + eax*2]
shl eax, 3
sub eax, ecx
mov ecx, dword [esp + 0x40]
add eax, ebp
imul eax, eax, 0x3c
sub eax, ecx
add eax, ebx
imul eax, eax, 0x3c
sub eax, edx
add eax, edi
cmp eax, 0xe10
jne 0x4af00f
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov ecx, 0x3c
sub ecx, ebx
imul ecx, ecx, 0x3c
sub ecx, edi
add eax, ecx
mov byte [edx], 1
jmp 0x4af030
cmp eax, 0xfffff1f0
mov eax, dword [esp + 0x64]
jne 0x4af023
imul ebx, ebx, 0x3c
neg edi
sub edi, ebx
add eax, edi
mov edx, dword [esp + 0x6c]
mov byte [edx], 1
jmp 0x4af030
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
imul ecx, ecx, 0x15180
add eax, ecx
cmp eax, 1
pop ebp
pop ebx
jl 0x4af054
cmp eax, 0x7fffffff
jle 0x4af056
xor eax, eax
pop edi
pop esi
add esp, 0x50
ret
Function at 0x40426e
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x467590
sub esp, 8
mov eax, dword [esp + 0x10]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
push edi
mov dword [esi], eax
mov dword [esi + 4], ecx
mov ecx, dword [ecx]
lea edx, [esp + 8]
push edx
mov edx, dword [eax]
push ecx
or edi, 0xffffffff
push edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call fcn.00408bc5
add esp, 0xc
test eax, eax
je 0x4676d7
mov eax, dword [0x9798bc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x108]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov dword [esi + 0x20], eax
mov dword [esi + 0xc], ecx
mov ecx, dword [edx]
mov eax, dword [ecx]
push ebx
push ebp
call dword [eax + 0x2c]
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
mov ecx, dword [ecx]
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x10]
and eax, edx
cmp eax, edi
lea ebx, [esi + 0x2c]
lea ebp, [esi + 0x30]
mov dword [ebx], 0
mov dword [ebp], 0
je 0x467694
push 0x60
call fcn.0040105a
add esp, 4
test eax, eax
je 0x46763e
mov ecx, eax
call fcn.00406569
mov edi, eax
jmp 0x467640
xor edi, edi
mov dword [edi + 0x50], 1
mov dword [edi + 0x54], 0
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.00403427
test eax, eax
jne 0x467677
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
push edx
mov edx, dword [ecx]
push eax
push edx
mov ecx, edi
call fcn.00405eed
mov dword [ebx], edi
mov dword [esi], ebx
jmp 0x467694
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
push eax
mov eax, dword [edx]
push ecx
push eax
mov ecx, edi
call fcn.00405eed
mov dword [ebp], edi
mov dword [esi + 4], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
pop ebp
pop ebx
je 0x4676c3
mov edx, dword [ecx]
call dword [edx + 0x158]
cmp eax, 2
jne 0x4676c3
mov eax, 1
mov dword [esi + 0x34], eax
pop edi
mov dword [esi + 8], 0x403058
xor eax, eax
pop esi
add esp, 8
ret 0x10
xor eax, eax
pop edi
mov dword [esi + 0x34], eax
mov dword [esi + 8], 0x403058
pop esi
add esp, 8
ret 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.004054b6
pop edi
pop esi
add esp, 8
ret 0x10
Function at 0x404453
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4ca450
sub esp, 0x94
mov eax, dword [0x93e25c]
push esi
mov dword [esp + 0x94], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.005e6740
mov ecx, dword [esp + 0xa8]
push 0x14
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.005e6f70
mov esi, dword [esp + 0xb8]
push 0x14
lea eax, [esp + 0x44]
push esi
push eax
call fcn.005e6f70
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.005e6f10
mov ecx, dword [esp + 0xc4]
lea eax, [esp + 0x2c]
mov edx, eax
add esp, 0x24
sub ecx, edx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
lea edx, [esp + 0x1c]
cmp eax, edx
jb 0x4ca4b7
lea eax, [esp + 0x30]
push eax
call fcn.005e6740
push 0x14
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.005e6f70
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.005e6f10
add esp, 0x18
mov ecx, 0x14
lea edi, [esp + 0x1c]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x4ca508
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x90]
call fcn.006cedd0
add esp, 0x94
ret

Function at 0x404fd9
Capabilities:
Compare security identifiers

Disassembly:
jmp 0x4b8810
sub esp, 0x418
mov eax, dword [0x93e25c]
push ebx
mov dword [esp + 0x418], eax
lea eax, [esp + 4]
push eax
xor ebx, ebx
push 1
push 8
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4b8893
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4b887d
lea ecx, [esp + 4]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4b8893
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
call fcn.006cedd0
add esp, 0x418
ret
mov ecx, dword [esp + 4]
push esi
lea edx, [esp + 0x10]
push edx
push 0x400
lea eax, [esp + 0x24]
push eax
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x4b88d8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
call fcn.006cedd0
add esp, 0x418
ret
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4b88c1
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
xor esi, esi
cmp eax, ebx
jbe 0x4b8935
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
push edi
lea edi, [esp + 0x28]
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
push edx
push eax
call ebx
test eax, eax
jne 0x4b892f
mov eax, dword [esp + 0x24]
inc esi
add edi, 8
cmp esi, eax
jb 0x4b8913
jmp 0x4b8934
mov ebp, 1
pop edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x420]
mov eax, ebp
pop ebp
pop esi
pop ebx
call fcn.006cedd0
add esp, 0x418
ret
Function at 0x4084f4
Capabilities:
Terminate process

Disassembly:
jmp 0x4b24c0
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4b2507
push str.Aborting_n
call fcn.004058b2
add esp, 4
mov eax, 1
push eax
call fcn.004b0640
call fcn.004b0940
call fcn.004b0980
mov eax, dword [0x974a28]
neg eax
sbb eax, eax
and eax, 3
push eax
call fcn.005dbcd0
add esp, 8
push esi
call fcn.006cf0c8
pop esi
mov al, byte [0x973f14]
test al, al
je 0x4b24d6
xor eax, eax
jmp 0x4b24db
Function at 0x408fc1
Capabilities:
Delete service

Disassembly:
jmp 0x4b9110
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push ebp
push ebx
mov esi, ecx
call fcn.00409980
test eax, eax
jne 0x4b912c
pop esi
pop ebp
pop ebx
ret 4
push edi
push 2
push ebp
push ebp
mov dword [esi + 0xd0], ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x4b9159
push str.Failed_to_remove_the_service__Couldnt_open_the_SCM__n
call fcn.006d1d9e
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push 0x10000
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebp
je 0x4b91ba
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4b9199
push str.Failed_to_remove_the_service_n
call fcn.006d1d9e
add esp, 4
push esi
call ebx
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push str.Service_successfully_removed._n
call fcn.006d1d9e
add esp, 4
push esi
mov ebp, 1
call ebx
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4
push str.Failed_to_remove_the_service__Couldnt_open_the_service__n
call fcn.006d1d9e
add esp, 4
push edi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x4090bb
Capabilities:
Create service
Persist via windows service

Disassembly:
jmp 0x4b8fa0
sub esp, 0x108
mov eax, dword [0x93e25c]
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
push 1
push ebx
mov dword [esp + 0x118], eax
mov esi, ecx
xor ebp, ebp
call fcn.00409980
test eax, eax
jne 0x4b8fe4
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x104]
call fcn.006cedd0
add esp, 0x108
ret 0x18
push edi
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4b901b
push str.Failed_to_install_the_service__Couldnt_open_the_SCM__n
call fcn.006d1d9e
add esp, 4
jmp 0x4b90a1
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
mov eax, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x134]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push eax
mov eax, dword [esp + 0x134]
xor edx, edx
cmp eax, 1
mov eax, dword [esi + 8]
setne dl
push ecx
mov ecx, dword [esi + 4]
add edx, 2
push edx
mov edx, dword [esp + 0x144]
push eax
push ecx
push edx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x4b9089
push str.Failed_to_install_the_service__Couldnt_create_service__n
call fcn.006d1d9e
add esp, 4
jmp 0x4b909e
push str.Service_successfully_installed._n
call fcn.006d1d9e
add esp, 4
push esi
call ebx
mov ebp, 1
push edi
call ebx
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
call fcn.006cedd0
add esp, 0x108
ret 0x18
Function at 0x40989a
Capabilities:
Resolve dns

Disassembly:
jmp 0x44da80
push ebx
mov ebx, dword [esp + 0xc]
push esi
push 0x7f000001
mov dword [ebx], 0
call sub.WSOCK32.dll_htonl
mov esi, dword [esp + 0xc]
cmp dword [esi], eax
jne 0x44daa6
mov eax, dword [str.localhost]
pop esi
pop ebx
ret
mov eax, dword [0x974be0]
test ah, 2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jne 0x44db1c
mov eax, dword [0x972cb4]
add eax, 0x24
push eax
call edi
mov ecx, dword [0x972cb4]
push 0
push esi
call fcn.00403ee0
mov esi, eax
test esi, esi
je 0x44db11
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x44dae8
xor edi, edi
jmp 0x44daf5
push 0
push eax
call fcn.005d8c40
add esp, 8
mov edi, eax
mov edx, dword [0x972cb4]
mov ecx, dword [esi + 0xc]
add edx, 0x24
push edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
ret
mov eax, dword [0x972cb4]
add eax, 0x24
push eax
call ebp
push 0x972cb8
call edi
mov ecx, dword [esp + 0x14]
push 2
mov ebx, 4
push ebx
push ecx
call sub.WSOCK32.dll_gethostbyaddr
test eax, eax
jne 0x44db69
push 0x972cb8
call ebp
call fcn.006cee9e
cmp dword [eax], 0x2af9
je 0x44dc1c
call fcn.006cee9e
cmp dword [eax], 0x2afc
je 0x44dc1c
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [eax]
cmp byte [eax], 0
jne 0x44db89
push 0x972cb8
call ebp
mov ecx, dword [esp + 0x14]
xor eax, eax
call fcn.0044d860
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
push 0
push eax
call fcn.005d8c40
mov esi, eax
add esp, 8
test esi, esi
jne 0x44dba8
push 0x972cb8
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
push esi
call sub.WSOCK32.dll_gethostbyname
push 0x972cb8
mov edi, eax
call ebp
test edi, edi
jne 0x44dbcb
push esi
call fcn.005d8be0
add esp, 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
movzx edx, byte [esi]
mov ecx, dword [0x843bf8]
test byte [edx + ecx + 1], bl
je 0x44dbf7
movzx edx, byte [esi + 1]
test byte [edx + ecx + 1], bl
lea eax, [esi + 1]
je 0x44dbf2
movzx edx, byte [eax + 1]
inc eax
test byte [edx + ecx + 1], bl
jne 0x44dbe7
cmp byte [eax], 0x2e
je 0x44dc13
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x44dc13
mov edi, dword [esp + 0x14]
mov edx, dword [edi]
cmp dword [eax], edx
je 0x44dc2e
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
jne 0x44dc06
push esi
call fcn.005d8be0
add esp, 4
mov ecx, dword [esp + 0x14]
xor eax, eax
call fcn.0044d860
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
mov eax, esi
mov ecx, edi
call fcn.0044d860
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret
Function at 0x409980
Capabilities:
Query service configuration
Query service status

Disassembly:
jmp 0x4b8cf0
sub esp, 0x1c
push ebx
push ebp
push esi
push 2
xor ebp, ebp
push ebp
push ebp
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4b8d61
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4b8d49
push str.Install_Remove_of_the_Service_Denied__n
call fcn.006d1d9e
add esp, 4
mov ecx, esi
call fcn.00404fd9
test eax, eax
jne 0x4b8e99
push str.That_operation_should_be_made_by_an_user_with_Administrator_privileges__n
call fcn.006d1d9e
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
push str.There_is_a_problem_for_to_open_the_Service_Control_Manager__n
call fcn.006d1d9e
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x30]
push 0xf01ff
cmp eax, 1
mov eax, dword [esp + 0x30]
push eax
push ebx
jne 0x4b8e01
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4b8dea
push edi
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push str.The_service_already_exists__n
mov edi, eax
call fcn.006d1d9e
add esp, 4
lea ecx, [esp + 0x30]
push ecx
push 0x1000
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x4b8dc9
mov edx, dword [edi + 0xc]
push edx
push str.The_current_server_installed:__s_n
call fcn.006d1d9e
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
push ebx
mov ebp, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4b8e2c
push str.The_service_doesnt_exist__n
call fcn.006d1d9e
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4b8e8b
mov eax, dword [esp + 0x10]
cmp eax, 4
jne 0x4b8e72
push str.Failed_to_remove_the_service_because_the_service_is_running_nStop_the_service_and_try_again_n
call fcn.006d1d9e
add esp, 4
jmp 0x4b8e8b
cmp eax, 3
jne 0x4b8e86
push str.Failed_to_remove_the_service_because_the_service_is_in_stop_pending_state__nWait_30_seconds_and_try_again._nIf_this_condition_persist__reboot_the_machine_and_try_again_n
call fcn.006d1d9e
add esp, 4
jmp 0x4b8e8b
mov ebp, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x40bb54
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4ca310
sub esp, 0x94
mov eax, dword [0x93e25c]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x28]
push esi
push eax
call fcn.005e6740
mov edx, dword [esp + 0xa8]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca340
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x34]
push ecx
call fcn.005e6f70
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.005e6f10
lea ecx, [esp + 0x40]
push ecx
call fcn.005e6740
push 0x14
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.005e6f70
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.005e6f10
lea eax, [esp + 0x58]
push eax
call fcn.005e6740
mov ecx, dword [esp + 0xd0]
push 0x14
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.005e6f70
push 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.005e6f70
mov esi, dword [esp + 0xe4]
add esp, 0x48
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.005e6f10
lea ecx, [esi + 0x14]
add esp, 8
cmp esi, ecx
mov eax, esi
jae 0x4ca3f6
push ebx
push edi
lea edi, [esp + 0xc]
sub edi, esi
mov bl, byte [eax]
mov dl, byte [edi + eax]
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x4ca3e6
pop edi
pop ebx
mov ecx, dword [esp + 0x94]
pop esi
call fcn.006cedd0
add esp, 0x94
ret
Function at 0x467755
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x467750
mov eax, dword [0x9798bc]
push esi
mov esi, ecx
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x108]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 8]
push edi
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi], eax
mov dword [esi + 4], ecx
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
pop edi
mov dword [esi + 0x28], eax
mov dword [esi + 8], 0x403058
pop esi
ret 8
Function at 0x478294
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x478290
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
push edi
je 0x4782fb
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
call dword [edx + 0x38]
mov ecx, dword [esi + 0x4c]
mov edi, dword [ecx + 4]
mov bl, byte [edi + 0x33]
test bl, bl
jne 0x4782c7
mov ecx, dword [ecx]
mov bl, byte [ecx + 0x33]
test bl, bl
jne 0x4782c7
xor cl, cl
jmp 0x4782c9
mov cl, 1
test cl, cl
mov byte [esi + 0x33], cl
jne 0x47842e
mov ecx, dword [esi + 0xa8]
and ecx, eax
mov eax, dword [esi + 0xac]
and eax, edx
or ecx, eax
je 0x47842e
mov eax, dword [esi + 0xa0]
pop edi
pop esi
xor edx, edx
pop ebx
add esp, 0x14
ret
mov edx, dword [esi + 0x4c]
mov ecx, dword [edx]
mov eax, dword [ecx]
lea edx, [esi + 0x78]
push edx
call dword [eax + 0x3c]
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
lea eax, [esi + 0x8c]
push eax
call dword [edx + 0x3c]
test ebx, ebx
je 0x47842a
test eax, eax
je 0x47842a
mov byte [esi + 0x33], 0
mov ecx, dword [ebx + 4]
push ebp
mov ebp, dword [eax + 4]
mov edx, ebp
sub edx, ecx
mov dword [esp + 0x1c], ecx
js 0x47841e
mov eax, dword [eax]
mov edi, dword [esi + 0xb0]
mov ecx, dword [edi + 0x64]
mov esi, eax
add ebp, esi
push ebp
push esi
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
push edx
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0
call dword [ecx + 0x20]
add esp, 0x10
test eax, eax
jle 0x4783ee
lea esp, [esp]
mov edx, dword [esp + 0x18]
lea ebx, [eax + esi]
xor ecx, ecx
cmp ebx, ebp
sete cl
xor eax, eax
cmp edx, 0x2c
sete al
test eax, eax
jne 0x47839e
test ecx, ecx
je 0x4783d7
mov edx, dword [esp + 0x10]
inc edx
test ecx, ecx
mov dword [esp + 0x10], edx
je 0x4783b1
test eax, eax
jne 0x4783b1
mov esi, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [edi + 0x68]
push 0
push edx
push eax
mov eax, dword [esp + 0x20]
sub esi, eax
push esi
push eax
push edi
call dword [ecx + 4]
add esp, 0x18
test eax, eax
je 0x478411
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0x64]
push ebp
push ebx
lea edx, [esp + 0x20]
push edx
push edi
mov esi, ebx
call dword [ecx + 0x20]
add esp, 0x10
test eax, eax
jg 0x478380
sub esi, dword [esp + 0x14]
jne 0x47841e
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x47841e
cmp dword [esp + 0x18], 0x2c
jne 0x47841e
mov eax, dword [esp + 0x10]
pop ebp
pop edi
inc eax
pop esi
cdq
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
cdq
pop ebx
add esp, 0x14
ret
pop ebp
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x14
ret
mov byte [esi + 0x33], 1
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x14
ret