joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408550
Capabilities:
Enumerate threads
Suspend thread
Terminate thread

Disassembly:
sub esp, 0x20
xor eax, eax
push ebp
push eax
push 4
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40858c
xor eax, eax
pop ebp
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
push esi
push eax
push 0
push 0x1fffff
mov dword [esp + 0x18], 0x1c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x10], eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40860f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
push edi
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x20], edx
jne 0x4085fe
mov eax, dword [esp + 0x1c]
push eax
push 0
push 0x1fffff
call ebx
mov esi, eax
cmp edi, 1
jne 0x4085f0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4085f7
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4085c6
pop edi
pop ebx
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push ebp
call esi
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x408710
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
mov esi, dword [esp + 0x138]
push edi
push 0x128
lea eax, [esp + 0xc]
push 0
push eax
mov byte [esi], 0
call fcn.0042ea40
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x4087db
lea ecx, [esp + 8]
push ecx
push edi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4087db
push ebx
mov ebx, dword [esp + 0x13c]
lea edx, [esp + 0x30]
push edx
call fcn.004302ba
lea eax, [esp + 0x34]
push str._SYSTEM_PROCESS_
push eax
call fcn.0045306b
add esp, 0xc
test eax, eax
je 0x4087b2
lea ecx, [esp + 0x30]
push str.SYSTEM
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x4087b2
cmp ebx, dword [esp + 0x14]
je 0x4087c3
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408776
jmp 0x4087da
lea eax, [esp + 0x30]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4087d0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
call fcn.0042ea25
add esp, 0x12c
ret
Function at 0x408830
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push edi
push 0x128
or esi, 0xffffffff
lea eax, [esp + 0xc]
push 0
push eax
mov dword [0x467218], esi
mov dword [0x46721c], esi
mov dword [0x467220], esi
mov dword [0x467224], esi
call fcn.0042ea40
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x408912
lea ecx, [esp + 8]
push ecx
push edi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x408912
nop
lea edx, [esp + 0x2c]
push edx
call fcn.004302ba
lea eax, [esp + 0x30]
push str.CSRSS.EXE
push eax
call fcn.0045306b
add esp, 0xc
test eax, eax
jne 0x408903
cmp dword [0x467218], esi
jne 0x4088d4
mov ecx, dword [esp + 0x10]
mov dword [0x467218], ecx
jmp 0x408903
cmp dword [0x46721c], esi
jne 0x4088e8
mov edx, dword [esp + 0x10]
mov dword [0x46721c], edx
jmp 0x408903
cmp dword [0x467220], esi
jne 0x4088fb
mov eax, dword [esp + 0x10]
mov dword [0x467220], eax
jmp 0x408903
cmp dword [0x467224], esi
je 0x408932
lea ecx, [esp + 8]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4088a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0042ea25
add esp, 0x12c
ret
mov edx, dword [esp + 0x10]
mov dword [0x467224], edx
jmp 0x408919

Function at 0x408a30
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x160
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x15c], eax
push 0x104
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0x64]
push ecx
call fcn.004075a0
lea eax, [esp + 0x68]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a70
sub eax, edx
je 0x408b42
push 0x45bf98
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x408a96
mov byte [eax], 0
lea eax, [esp + 0x58]
dec eax
jmp 0x408aa0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408aa0
mov ecx, dword [str.chkvrtb.exe]
mov edx, dword [0x45bf90]
mov dword [eax], ecx
mov ecx, dword [0x45bf94]
mov dword [eax + 4], edx
lea edx, [esp + 0x58]
push edx
mov dword [eax + 8], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408b42
push edi
lea edi, [esp + 0x5c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408ad7
mov eax, dword [0x45bf88]
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [edi], eax
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 4]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.0042ea25
add esp, 0x160
ret
Function at 0x408dd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x114
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x110], eax
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0042ea40
lea ecx, [esp + 0x18]
push ecx
call fcn.004075a0
lea eax, [esp + 0x1c]
add esp, 0x10
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408e07
mov edx, dword [str.MCSTRT.EXE]
mov ecx, dword [0x45bfc8]
mov dword [eax], edx
mov edx, dword [0x45bfcc]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov word [esp + 8], ax
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 4]
push 0x45bfc0
push ecx
call fcn.0042ebd6
lea eax, [esp + 0xc]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x408e57
push esi
push edi
lea edi, [esp + 0x14]
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x408e70
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea edx, [esp + 0x18]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
call fcn.0042ea25
add esp, 0x114
ret
Function at 0x408eb0
Capabilities:
Enumerate processes
Move file

Disassembly:
sub esp, 0x338
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x334], eax
push ebp
push edi
push 0x128
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0042ea40
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, eax
test ebp, ebp
je 0x40903f
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40903f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
lea edx, [esp + 0x38]
push edx
call fcn.004302ba
mov eax, dword [esp + 0x20]
add esp, 4
push eax
push 0
push 0x410
call ebx
mov esi, eax
test esi, esi
je 0x40902a
push 0x104
lea ecx, [esp + 0x140]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [esp + 0x140]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call edi
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408f74
sub eax, edx
je 0x40902a
lea eax, [esp + 0x13c]
push eax
call fcn.004302ba
lea ecx, [esp + 0x140]
push str.TEMP_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
je 0x40902a
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408dd0
push 0x104
lea eax, [esp + 0x248]
push 0
push eax
call fcn.0042ea40
add esp, 0x10
xor eax, eax
mov cl, byte [esp + eax + 0x13c]
mov byte [esp + eax + 0x240], cl
inc eax
test cl, cl
jne 0x408fd0
lea eax, [esp + 0x240]
dec eax
jmp 0x408ff0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x408ff0
mov ecx, dword [str..np4.vir]
mov edx, dword [0x45bfd4]
mov dword [eax], ecx
mov cl, byte [0x45bfd8]
mov dword [eax + 4], edx
push 1
lea edx, [esp + 0x244]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408f16
pop esi
pop ebx
push ebp
call edi
mov ecx, dword [esp + 0x33c]
pop edi
pop ebp
xor ecx, esp
call fcn.0042ea25
add esp, 0x338
ret
Function at 0x409190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x68], eax
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x78]
xor ebx, ebx
push edi
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov byte [esp + 0x10], bl
mov word [esp + 0x11], ax
mov byte [esp + 0x14], bl
mov word [esp + 0x15], cx
mov byte [esp + 0x70], bl
mov dword [esp + 0x71], eax
mov byte [esp + 0x75], al
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x16]
movzx edx, word [esp + 0x14]
mov dword [esp + 0x54], eax
movsx eax, byte [esi + 1]
mov dword [esp + 0x58], ecx
movsx ecx, byte [esi]
push eax
sub edx, 0x76c
push ecx
mov dword [esp + 0x64], edx
lea edx, [esp + 0x14]
push str._c_c
push edx
call fcn.0042ebd6
movsx eax, byte [esi + 4]
movsx ecx, byte [esi + 3]
push eax
push ecx
lea edx, [esp + 0x28]
push str._c_c
push edx
call fcn.0042ebd6
movsx eax, byte [esi + 9]
movsx ecx, byte [esi + 8]
movsx edx, byte [esi + 7]
push eax
movsx eax, byte [esi + 6]
push ecx
push edx
push eax
lea ecx, [esp + 0x9c]
push 0x45c018
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x44]
push edx
call fcn.0042f8e3
movzx esi, ax
lea eax, [esp + 0x4c]
push eax
call fcn.0042f8e3
movzx eax, ax
movzx edx, ax
movzx ecx, si
lea eax, [esp + 0xac]
add esp, 0x40
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
call fcn.0042f8e3
movzx ecx, ax
sub ecx, 0x76c
mov dword [esp + 0x3c], ecx
sub esp, 0x20
mov edi, esp
mov ecx, 9
lea esi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
sub esp, 0x24
mov ecx, 9
lea esi, [esp + 0x6c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00409110
mov ecx, dword [esp + 0xbc]
add esp, 0x48
xor edx, edx
cmp eax, ebx
setle dl
pop edi
pop esi
pop ebx
xor ecx, esp
dec edx
and eax, edx
call fcn.0042ea25
add esp, 0x6c
ret
Function at 0x409ed0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x115]
push 0
push eax
call fcn.0042ea40
push 0x103
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.0042ea40
add esp, 0x18
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push eax
push 0
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x104
mov byte [esp + 0x128], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea edi, [esp + 0x110]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409f50
mov ecx, 6
mov esi, str.Net_Protectorchkvrtb.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x110]
push ecx
push 0x104
lea edx, [esp + 0x14]
push edx
push 0x45c138
movsw word es:[edi], word [esi]
push str.POPUP
push str.NOTIFICATION
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x24], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
push 0x45c138
push eax
call fcn.0045306b
add esp, 8
pop edi
pop esi
test eax, eax
je 0x409fd7
lea ecx, [esp + 4]
push 0x45c11c
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x409fd7
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0042ea25
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, 1
call fcn.0042ea25
add esp, 0x210
ret

Function at 0x40a4c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 8]
push edi
push eax
mov byte [esp + 0x10], 0
call fcn.004075a0
lea ecx, [esp + 0x10]
push ecx
call fcn.004302ba
mov ebx, dword [esp + 0x124]
add esp, 8
test ebx, ebx
jne 0x40a51d
lea edx, [esp + 0xc]
push str.ZVSCAN
push edx
call fcn.0042efa0
add esp, 8
test eax, eax
je 0x40a51d
mov byte [eax], bl
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a521
lea edi, [esp + 0xc]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a530
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test ebx, ebx
pop ebx
jne 0x40a556
push 5
lea eax, [esp + 4]
push eax
jmp 0x40a55d
push 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0042ea25
add esp, 0x108
ret
Function at 0x40a580
Capabilities:
Get disk information

Disassembly:
sub esp, 0x210
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x218]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
push esi
push edi
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0x129]
push 0
push edx
mov byte [esp + 0x130], 0
call fcn.0042ea40
add esp, 0x18
lea eax, [esp + 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
shr eax, 2
mov ebp, eax
xor edi, edi
lea esi, [esp + 0x118]
test ebp, ebp
jbe 0x40a664
push 0x104
lea ecx, [esp + 0x18]
push ecx
push esi
mov byte [esi + 2], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.0042efa0
add esp, 8
test eax, eax
jne 0x40a635
inc edi
add esi, 4
cmp edi, ebp
jb 0x40a604
jmp 0x40a664
lea eax, [esp + 0x14]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a640
sub eax, edx
add eax, ebx
push eax
mov eax, dword [esp + 0x14]
push esi
push 0x45c1e0
push 0x104
push eax
call fcn.0042ec6f
add esp, 0x14
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042ea25
add esp, 0x210
ret
Function at 0x40a9a0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x463460
push 0x42fba0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x468004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x7530
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 1
mov edi, dword [ebp + 8]
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
call ebx
test eax, eax
jne 0x40ab88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40aa5b
mov edx, dword [ebp - 0x1c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x40aa5b
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push esi
push 1
push edi
call ebx
test eax, eax
jne 0x40aa6f
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x468004
call fcn.0042fd2c
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp ebx, dword [ebp - 0x20]
jae 0x40ab7c
lea ecx, [ebx + ebx*8]
lea esi, [esi + ecx*4]
mov ecx, 9
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
push 0x24
mov edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jne 0x40aacd
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x468004
call fcn.0042fd2c
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov dword [ebp - 4], edi
lea edx, [ebp - 0x58]
push edx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40aa48
lea esp, [esp]
cmp dword [ebp - 0x54], edi
je 0x40ab50
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
push 0x24
lea eax, [ebp - 0x58]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40aaa6
cmp dword [ebp - 0x54], edi
je 0x40ab50
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jbe 0x40aaf0
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x468004
call fcn.0042fd2c
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call fcn.0040ab74
add ebx, edi
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x28]
jmp 0x40aa74
mov dword [ebp - 4], 0xfffffffe
call fcn.0040aba2
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b2a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x174
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x7d]
push ebx
push eax
mov byte [esp + 0x84], bl
call fcn.0042ea40
push 0x31
lea ecx, [esp + 0x55]
push ebx
push ecx
mov byte [esp + 0x5c], bl
call fcn.0042ea40
push 0x38
lea edx, [esp + 0x28]
push ebx
push edx
mov dword [esp + 0x2c], ebx
call fcn.0042ea40
add esp, 0x24
cmp dword [0x470294], ebx
je 0x40b308
push str.C:Windows_sysnative_taskkill.exe
lea eax, [esp + 0x7c]
push eax
jmp 0x40b312
push str.C:WindowsSystem32_taskkill.exe
lea ecx, [esp + 0x7c]
push ecx
call fcn.0042ebd6
add esp, 8
lea edx, [esp + 0x44]
push str._F__IM_explorer.exe
push edx
call fcn.0042ebd6
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
add esp, 8
lea edx, [esp + 8]
lea eax, [esp + 0x78]
lea ecx, [esp + 0x44]
push edx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], 0x440
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], str.open
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call esi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x100
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.0042ea40
lea ecx, [esp + 0x84]
push str.c:windowsexplorer.exe
push ecx
call fcn.0042ebd6
add esp, 0x14
lea eax, [esp + 8]
lea edx, [esp + 0x78]
push eax
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], 0x440
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], str.open
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0x45b5a5
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call esi
mov ecx, dword [esp + 0x178]
pop esi
pop ebx
xor ecx, esp
call fcn.0042ea25
add esp, 0x174
ret

Function at 0x40b590
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x34
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x4c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40b635
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b635
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x40b635
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x40b635
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1a]
movzx eax, word [esp + 0x18]
mov dword [edi], ecx
mov dword [ebx], edx
mov dword [ebp], eax
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042ea25
add esp, 0x34
ret