joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498de2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x498dc4
mov ecx, 0x4d1c30
call fcn.004908e7
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, eax
cmp word [esi + 8], 0
jne 0x498e70
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x498e4e
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
movzx ecx, cx
push 5
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x498e4e
push ebx
push edi
push eax
call fcn.0047a19a
add esp, 0xc
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 4], eax
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ax, word [ebx]
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, edi
call fcn.00402c6c
mov si, word [esi + 8]
xor eax, eax
pop edi
mov word [ebx], si
cmp si, 0xffff
pop esi
setne al
pop ebx
pop ebp
ret 0xc

Function at 0x49b990
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ecx
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x49b9bd
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x49b9ce
push 2
call edi
test ax, ax
jge 0x49b9ce
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004763c5
cmp dword [esi + 0x30], ebx
jne 0x49baa8
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, pe_nt_image_headers32
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.004763c5
cmp eax, dword [esp + 0x34]
jne 0x49baa8
push 1
push 0x209
push 0x200
push 0
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
jne 0x49ba44
push 1
push 0x109
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x49ba89
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x49baa8
cmp eax, 0x205
je 0x49baa8
cmp eax, 0x201
je 0x49baa8
cmp eax, 0x204
je 0x49baa8
cmp eax, ebx
jne 0x49ba6f
cmp dword [esp + 0x1c], 0x1b
je 0x49baa8
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x4d1c04]
jbe 0x49ba9e
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x49ba01
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x420860
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
xor esi, esi
call fcn.00420cd0
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x4209b6
add eax, 0x14
jo 0x4209b6
add eax, edx
jo 0x4209b6
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x4209b6
movsx ebp, ax
cmp ebp, ebx
jl 0x4209a7
lea ecx, [esp + 0x14]
push ecx
call fcn.004210b0
push 0x28
push edi
push eax
call fcn.00421000
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x42091e
test eax, 0x40000000
je 0x42090d
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x420943
test eax, 0x40000000
je 0x420936
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.004210b0
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x4209b6
push ecx
call fcn.00420fe0
test eax, eax
je 0x420990
add edi, 0x28
jo 0x4209b6
add ebx, 1
jo 0x4209b6
cmp ebx, ebp
jle 0x4208d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
mov esi, 4
call dword [sym.imp.KERNEL32.DLL_SetFileApisToANSI]
call dword [sym.imp.KERNEL32.DLL_SetFileApisToOEM]
call dword [sym.imp.USER32.DLL_WaitMessage]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x19df673e
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x352d25aa
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40166b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4016a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40169e
jmp 0x401690
cmp esi, eax
jae 0x4016a2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401690
cmp esi, eax
jb 0x4016a9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4025f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.00401ac0
mov ebx, eax
cmp ebx, esi
je 0x40266a
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x402655
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push esi
push eax
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4026ec
mov edi, edi
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.004025f0
mov ebx, eax
cmp ebx, esi
jne 0x402644
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push edx
mov dword [ebp - 0x214], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4026a0
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x402705
push eax
call ebx
mov dword [ebp - 0x210], esi
mov eax, dword [ebp - 0x218]
push eax
mov ecx, edi
mov dword [ebp - 0x20c], esi
call fcn.00401970
mov edi, eax
mov eax, dword [ebp - 0x210]
cmp eax, esi
je 0x402728
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret 4
Function at 0x406900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42af16
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x40697d
call fcn.00401740
mov edi, eax
jmp 0x406a62
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x406996
call fcn.00401740
jmp 0x406a59
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x4069b4
call fcn.00401740
jmp 0x406a59
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x41c], edi
cmp eax, edi
jae 0x4069d5
mov edi, 0x8007000e
jmp 0x406a5b
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00403950
mov dword [ebp - 4], 1
jmp 0x406a0d
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x406a1e
mov edi, 0x8007000e
jmp 0x406a5b
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x406a37
call fcn.00401740
jmp 0x406a59
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x418]
push eax
push ecx
lea ecx, [ebp - 0x42c]
call fcn.004059f0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x406a80
lea ecx, [ebp - 0x418]
call fcn.00402420
jmp 0x406a80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4082d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b19a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43f838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
call edx
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x440620
mov dword [ebp - 4], ebx
call edx
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov byte [ebp - 4], 3
call edx
add eax, 0x10
mov dword [esi + 0x2c], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov byte [ebp - 4], 4
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [0x440620]
mov edx, dword [eax + 0xc]
mov ecx, 0x440620
mov byte [ebp - 4], 5
call edx
add eax, 0x10
mov dword [esi + 0x38], eax
push 0x4406e4
lea ecx, [esi + 4]
mov byte [ebp - 4], 6
mov dword [esi + 0xc], ebx
mov word [esi + 0x10], bx
mov byte [esi + 0x12], bl
mov byte [esi + 0x24], bl
mov word [esi + 0x30], bx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], 0x7530
call fcn.00401300
push 0x4406e4
lea ecx, [esi + 8]
call fcn.00401300
mov word [esi + 0x1e], bx
mov dword [esi + 0x3c], 1
mov byte [esi + 0x1c], bl
mov word [esi + 0x40], bx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4092a2
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x409271
cmp eax, 2
jne 0x40928c
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x40929c
test eax, eax
je 0x409297
test al, 1
jne 0x40928c
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40929c
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x409700
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push ecx
push 0xff
lea edx, [ebp - 0x204]
push 0x100
push edx
call fcn.0041f4c8
xor eax, eax
add esp, 0x14
lea ecx, [ebp - 0x204]
mov word [ebp - 6], ax
mov dword [ebp - 0x208], ecx
cmp dword [esi + 0x260], eax
jne 0x40975d
mov edx, ecx
push edx
call fcn.0041f171
add esp, 4
add esi, 0x40
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x409792
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
Function at 0x409d20
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x409d79
push 1
lea eax, [ebx + 0x40]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x409d6a
push eax
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x409eb4
push 0x104
lea ecx, [ebp - 0x20e]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409e1a
cmp eax, 0x104
je 0x409e1a
mov edx, 0x22
mov word [ebp - 0x210], dx
mov ecx, edx
xor edx, edx
push 0xf003f
push edx
push edx
mov word [ebp + eax*2 - 0x20e], cx
mov word [ebp + eax*2 - 0x20c], dx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x409e2d
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x409e05
push str.Could_not_open_Service_Manager
lea ecx, [ebp - 0xa10]
push 0x400
push ecx
call fcn.00408ec0
add esp, 0xc
push 0
add ebx, 0x40
push ebx
lea edx, [ebp - 0xa10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 0xf01ff
lea edi, [ebx + 0x40]
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x409ea8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea ecx, [ebp - 0xa10]
push ecx
push 0xd80b
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x409e99
push str.Could_not_start_service
lea edx, [ebp - 0xa10]
push 0x400
push edx
call fcn.00408ec0
add esp, 0xc
push 0
push edi
lea eax, [ebp - 0xa10]
push eax
jmp 0x409e12
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
Function at 0x409ed0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0041ec60
mov eax, dword [0x43f838]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, ecx
mov dword [ebp - 0x1024], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x409f3b
push 1
lea ebx, [edi + 0x40]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x409f2a
push eax
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x409f30
mov edi, dword [ebp - 0x1024]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x409f51
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x409fab
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80a
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x409f9c
push str.Could_not_open_Service_Manager
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.00408ec0
add esp, 0xc
push 0
push ebx
lea edx, [ebp - 0x804]
push edx
jmp 0x40a0e8
push 0x10020
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40a009
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80c
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x409f9c
push str.Could_not_open_service
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.00408ec0
add esp, 0xc
push esi
push ebx
lea edx, [ebp - 0x804]
push edx
jmp 0x40a0e8
lea eax, [ebp - 0x1020]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40a082
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x40a082
cmp eax, 0x425
jne 0x40a03a
cmp dword [ebp - 0x101c], 3
je 0x40a082
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0xd80e
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x40a070
push str.Could_not_stop_service
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.00408ec0
add esp, 0xc
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1024], eax
call esi
push edi
call esi
cmp dword [ebp - 0x1024], 0
jne 0x409f3b
push 0x400
lea ecx, [ebp - 0x1004]
push ecx
push 0xd80d
call fcn.00409020
add esp, 0xc
test eax, eax
jne 0x40a0de
push str.Could_not_delete_service
lea edx, [ebp - 0x1004]
push 0x400
push edx
call fcn.00408ec0
add esp, 0xc
push 0
push ebx
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041e9a6
mov esp, ebp
pop ebp
ret
Function at 0x40a9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x40a9f1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x409ce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x40aa18
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b100
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
call fcn.00409ed0
test eax, eax
jne 0x40b11e
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4406a4]
push ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x65
xor ebx, ebx
push ecx
mov dword [ebp - 0x1c], str.APPID
mov dword [ebp - 0x18], str.29423E88_D05F_477B_A0C2_E7BB802FEB54
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00406d70
cmp eax, ebx
jl 0x40b250
push esi
push 0x20006
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00401ac0
cmp eax, ebx
je 0x40b19a
push eax
call fcn.00401760
mov esi, eax
mov eax, dword [ebp - 0x18]
add esp, 4
cmp eax, ebx
je 0x40b18f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x18]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str.29423E88_D05F_477B_A0C2_E7BB802FEB54
push esi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00401a20
cmp eax, ebx
je 0x40b1f0
push eax
call fcn.00401760
mov edi, eax
mov eax, dword [ebp - 0xc]
add esp, 4
cmp eax, ebx
je 0x40b1da
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x40b1e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0xc]
push str.LocalService
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0xc]
cmp byte [ebp + 8], bl
je 0x40b240
push 1
lea eax, [edi + 0x40]
push eax
push str.LocalService
call fcn.00401b90
mov ecx, edi
call fcn.00409d20
lea ecx, [ebp - 0xc]
test eax, eax
jne 0x40b240
call fcn.004025d0
lea ecx, [ebp - 0x18]
call fcn.004025d0
pop esi
pop ebx
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 4
call fcn.004025d0
lea ecx, [ebp - 0x18]
call fcn.004025d0
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4