joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412070
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9918
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], vtable.StringStorage.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], vtable.StringStorage.0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0041da00
test al, al
je 0x41215a
push str._service
push dword [ebp - 0x20]
lea eax, [ebp - 0x34]
push 0x525a10
push eax
call fcn.004038c0
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.StringStorage.0
call fcn.004039c0
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00420820
push 0
push 0
push 0x524da8
push 0
push 0
mov byte [ebp - 4], 4
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x18]
push 1
push 2
push 0x10
push 0xf01ff
push 0x4c9428
push 0x4c9448
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
je 0x41221c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
push 2
push edi
mov dword [ebp - 0x10], 0x1388
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x4121fc
push esi
call edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.StringStorage.0
call fcn.004039c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x70]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x70]
push eax
call fcn.0049c518
int3
Function at 0x41c540
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4babb3
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea esi, [eax + 4]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push dword [ebp + 8]
mov dword [eax], vtable.WinCommandLineArgs.0
call fcn.00403030
mov dword [ebp - 0x34], vtable.UnicodeStringStorage.0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
push dword [eax + 4]
call fcn.004030f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x58], vtable.StringStorage.0
call fcn.004039c0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub eax, ecx
sar eax, 1
add eax, 0xffffffff
je 0x41c705
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x41c72b
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x41c6fe
nop dword [eax]
push dword [ebx + edi*4]
lea ecx, [ebp - 0x44]
call fcn.00405a40
mov dword [ebp - 0x24], vtable.StringStorage.0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
push eax
push 1
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x24]
push 0x524da8
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
push dword [ebp - 0x40]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
sar eax, 1
add eax, 0xffffffff
je 0x41c6d2
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x41c6c6
mov dword [ecx], vtable.StringStorage.0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 8
mov eax, dword [ecx]
push dword [ebp - 0x20]
call dword [eax + 4]
add dword [esi + 4], 0x10
jmp 0x41c6d2
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esi
call fcn.0041c750
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.StringStorage.0
call fcn.004039c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], vtable.UnicodeStringStorage.0
call fcn.004039c0
inc edi
cmp edi, dword [ebp + 8]
jl 0x41c610
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], vtable.UnicodeStringStorage.0
call fcn.004039c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x48]
push 0x5296cc
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x48]
push 0x5520b8
push eax
call fcn.0049c518
int3
Function at 0x41d640
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bad88
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push esi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x41d680
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41d695
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x28], 0
lea eax, [ebp - 0x98]
mov ecx, esi
push eax
call fcn.0041d590
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0041d7a0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x98]
push eax
movzx eax, byte [esi + 0x3c]
push 0
push 0
push 0
push eax
push 0
push 0
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41d709
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x24], eax
mov dword [ebp - 0x1c], vtable.StringStorage.0
call fcn.004039c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x54]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x54]
push eax
call fcn.0049c518
int3

Function at 0x41dcd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
xorps xmm0, xmm0
mov dword [esp + 0x44], 0
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x4c], xmm0
push eax
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
mov dword [esp + 0x68], 0
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0x440
mov dword [esp + 0x3c], str.runas
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x4c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41dd57
push 0xffffffffffffffff
push dword [esp + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 4]
call fcn.0041ce10
push 0x5521e4
lea eax, [esp + 8]
push eax
call fcn.0049c518
int3
Function at 0x41e340
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baf78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x20]
xor edx, edx
test ecx, ecx
je 0x41e37a
cmp byte [ecx + 0x10], dl
lea eax, [ecx + 4]
cmove edx, eax
mov eax, dword [esi + 0x28]
push edx
push 0
push eax
push eax
push 0xff
push 0
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x24], eax
cmp eax, 0xffffffff
je 0x41e3af
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.00402fa0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.CreateNamedPipe_failed__error_code___d
push eax
call fcn.004038c0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00403150
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x30]
push 0x5520b8
push eax
call fcn.0049c518
int3
Function at 0x41e400
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bafca
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x24]
cmp ecx, 0xffffffff
jne 0x41e43b
mov ecx, esi
call fcn.0041e340
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
push ecx
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x41e514
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x217
je 0x41e4d6
cmp edi, 0x3e5
jne 0x41e560
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41e48e
push dword [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x41e4d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00402fa0
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push str.GetOverlappedResult___failed_after_the_ConnectNamedPipe___call__error_code___d
push eax
call fcn.004038c0
add esp, 0xc
lea ecx, [ebp - 0x20]
jmp 0x41e584
push 0xa0
call fcn.0049adb4
add esp, 4
mov dword [ebp - 0x10], eax
push 1
mov dword [ebp - 4], 3
mov ecx, eax
push dword [esi + 0x28]
push dword [esi + 0x24]
call fcn.00421b00
mov dword [esi + 0x24], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00402fa0
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push str.ConnectNamedPipe_failed__error_code___d
push eax
call fcn.004038c0
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00403150
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x34]
push 0x5520b8
push eax
call fcn.0049c518
lea ecx, [ebp - 0x30]
call fcn.00402fa0
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push str.ConnectNamedPipe_failed__error_code___d
push eax
call fcn.004038c0
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00403150
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x5c]
push 0x5520b8
push eax
call fcn.0049c518
int3
Function at 0x41f880
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb29b
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
lea esi, [ebx + 4]
mov dword [ebx], vtable.StringStorage.0
mov dword [ebp - 0x20], ebx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x524da8
push ecx
call fcn.0049dfe0
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x41fa4b
push ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0041fac0
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x2c]
push esi
push edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41fa4b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x52a65c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41fa4b
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], 0x52a660
movzx edx, word [eax + 0x16]
movzx edi, word [eax + 0x12]
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x14]
cmp edx, 0x64
jbe 0x41f9a4
inc ecx
mov dword [ebp + 8], 0x52a664
add edx, 0xff9c
cmp cx, 0x64
jb 0x41f9a4
xor ecx, ecx
inc edi
test dx, dx
jne 0x41f9c6
test ax, ax
jne 0x41f9ea
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d
push ebx
call fcn.004038c0
add esp, 0x10
jmp 0x41fa08
test ax, ax
jne 0x41f9ea
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d_s_d
push ebx
call fcn.004038c0
add esp, 0x18
jmp 0x41fa08
push eax
movzx eax, dx
push eax
push dword [ebp + 8]
movzx eax, cx
push eax
movzx eax, di
push eax
push str._d._d_s_d._d
push ebx
call fcn.004038c0
add esp, 0x1c
test esi, esi
je 0x41fa35
mov ecx, dword [ebp - 0x24]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x41fa2b
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa61
push ecx
push esi
call fcn.0049ade4
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x54]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x54]
push eax
call fcn.0049c518
call fcn.004a1eab
int3
Function at 0x420430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb408
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42047a
push eax
call edi
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x28]
test eax, eax
je 0x42048b
push eax
call edi
mov dword [esi + 0x28], 0
push dword [esi + 0x18]
push dword [esi + 8]
push 0x52a6b4
push dword [esi + 0x40]
call fcn.00405ec0
add esp, 0x10
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.0041d590
push dword [ebp - 0x50]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
push dword [ebp - 0x7c]
push str.sti:_cb___d__hStdError___p__hStdInput___p__hStdOutput___p__dwFlags___u
push dword [esi + 0x40]
call fcn.00405f20
add esp, 0x1c
mov dword [ebp - 4], 0
mov edx, dword [esi + 0x40]
mov cl, byte [esi + 0x44]
call fcn.0041f3f0
mov ebx, eax
mov ecx, esi
lea eax, [ebp - 0x24]
push eax
call fcn.0041d7a0
mov byte [ebp - 4], 1
movzx eax, byte [esi + 0x3c]
push eax
push dword [ebp - 0x20]
push ebx
push str.Try_CreateProcessAsUser__p__0___s__0__0___d__NORMAL_PRIORITY_CLASS__0__0__sti__pi_
push dword [esi + 0x40]
call fcn.00405f20
add esp, 0x14
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
movzx eax, byte [esi + 0x3c]
push 0
push 0
push 0x20
push eax
push 0
push 0
push dword [ebp - 0x20]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x420596
push dword [ebp - 0x20]
push str.Created___s__process
push dword [esi + 0x40]
call fcn.00405ec0
add esp, 0xc
push ebx
call edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.StringStorage.0
call fcn.004039c0
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa4]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0xa4]
push eax
call fcn.0049c518
int3
Function at 0x4205c0
Capabilities:
Migrate process to active window station

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb438
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0xc]
push str.TvnWindowsApplicationClass
mov dword [edi], vtable.WindowsApplication.0
mov dword [edi + 4], eax
mov dword [edi + 8], 0
call fcn.00403030
push 0x10000000
push 1
mov dword [ebp - 4], 0
push 0x52a8bc
mov dword [edi], vtable.LocalWindowsApplication.0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov esi, eax
test esi, esi
je 0x42067f
push esi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push esi
test eax, eax
jne 0x420645
call dword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x42067f
call dword [sym.imp.USER32.dll_CloseWindowStation]
push 0x400001cf
push 1
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x38]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x38]
push eax
call fcn.0049c518
int3

Function at 0x4208d0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb460
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0
push ecx
mov dword [ebp - 4], 0
call fcn.00420c10
jmp 0x42091d
push 0xf01ff
mov dword [ebp - 4], 0xffffffff
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x4c9448
push dword [esi + 4]
call ebx
mov edi, eax
test edi, edi
je 0x4209d2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
test eax, eax
je 0x4209e8
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push 0x4c9448
push dword [esi + 4]
xor edi, edi
call ebx
test eax, eax
je 0x42099d
nop
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
inc edi
cmp eax, 0xa
jg 0x4209b1
push 0xf01ff
push 0x4c9448
push dword [esi + 4]
call ebx
test eax, eax
jne 0x420970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x42e
lea ecx, [ebp - 0x90]
call fcn.0041ced0
push 0x5521e4
lea eax, [ebp - 0x90]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x40]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x40]
push eax
call fcn.0049c518
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x68]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x68]
push eax
call fcn.0049c518
int3
Function at 0x420a10
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb480
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x14
push 0x4c9448
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x420ad6
push edi
mov dword [ebp - 4], 0
call fcn.00420d60
cmp eax, 4
je 0x420b20
cmp eax, 2
je 0x420b20
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x420aec
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
push edi
call fcn.00420d60
cmp eax, 4
je 0x420aa9
dec esi
test esi, esi
jle 0x420b02
push 0x3e8
call ebx
jmp 0x420a90
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x3c]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x3c]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x64]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x64]
push eax
call fcn.0049c518
push 3
lea ecx, [ebp - 0x90]
call fcn.004207a0
push 0x552238
lea eax, [ebp - 0x90]
push eax
call fcn.0049c518
push 2
lea ecx, [ebp - 0xbc]
call fcn.004207a0
push 0x552238
lea eax, [ebp - 0xbc]
push eax
call fcn.0049c518
int3

Function at 0x420c10
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb4a0
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x554008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x24
push 0x4c9448
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
je 0x420cf0
push edi
mov dword [ebp - 4], 0
call fcn.00420d60
cmp eax, 1
je 0x420d40
cmp eax, 3
je 0x420d40
lea eax, [ebp - 0x30]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x420d06
cmp byte [ebp + 0xc], 0
je 0x420cb9
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
nop
push edi
call fcn.00420d60
cmp eax, 1
je 0x420cb9
dec esi
test esi, esi
jle 0x420d22
push 0x3e8
call ebx
jmp 0x420ca0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049a89b
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x5c]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x5c]
push eax
call fcn.0049c518
lea ecx, [ebp - 0x84]
call fcn.0041ce10
push 0x5521e4
lea eax, [ebp - 0x84]
push eax
call fcn.0049c518
push 1
lea ecx, [ebp - 0xb0]
call fcn.004207a0
push 0x552238
lea eax, [ebp - 0xb0]
push eax
call fcn.0049c518
push 0
lea ecx, [ebp - 0xdc]
call fcn.004207a0
push 0x552238
lea eax, [ebp - 0xdc]
push eax
call fcn.0049c518
int3