joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401310
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.EulaAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x401310
cmp dword [ebp - 8], 0
je 0x401310
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push str.SoftwareMicrosoftwindows_ntcurrentversion
xor esi, esi
mov dword [ebp - 0x214], 0x208
push 0x80000002
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4014d0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push 0x41e434
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4014c4
lea eax, [ebp - 0x20c]
push eax
push str.iotuap
call fcn.00404b92
add esp, 8
mov ecx, 1
test eax, eax
cmove esi, ecx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405755
mov esp, ebp
pop ebp
ret

Function at 0x4014f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
xor esi, esi
mov dword [ebp - 0xc], 0
push 0x80000002
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401562
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.NanoServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401559
cmp dword [ebp - 8], 4
jne 0x401559
mov eax, 1
cmp dword [ebp - 0xc], eax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4018d0
Capabilities:
Terminate process

Disassembly:
push dword [0x4250c4]
push 0x41e4c8
call fcn.00405391
push str.This_is_the_first_run_of_this_program._You_must_accept_EULA_to_continue._n
call fcn.00405391
push str.Use__accepteula_to_accept_EULA._n_n
call fcn.00405391
add esp, 0x10
push 1
call fcn.004050a0
int3
Function at 0x4022d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4023d7
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.004050ec
add esp, 4
mov edi, eax
lea eax, [ebp - 0x108]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
push 0x41e69c
push edi
call fcn.00402510
push 0x41e6ac
push edi
mov esi, eax
call fcn.00402510
push 0x41e6b8
push edi
mov ebx, eax
call fcn.00402510
push 0x41e6c8
push edi
mov dword [ebp - 0x10c], eax
call fcn.00402510
push 0x41e6d8
push edi
mov dword [ebp - 0x110], eax
call fcn.00402510
add esp, 0x28
mov edi, eax
call fcn.00401570
push edi
push dword [ebp - 0x110]
push dword [ebp - 0x10c]
push ebx
push esi
push str._n_s_v_s____s_n_s_n_s_n_n
test eax, eax
je 0x4023b5
call fcn.00405eea
add eax, 0x20
push eax
call fcn.00406341
call fcn.00405eea
add eax, 0x20
jmp 0x4023cb
call fcn.00405eea
add eax, 0x40
push eax
call fcn.00406341
call fcn.00405eea
add eax, 0x40
push eax
call fcn.00406079
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret

Function at 0x4023f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4024f7
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004050ec
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20c]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
push 0x41e5e4
push edi
call fcn.004025c0
push 0x41e600
push edi
mov esi, eax
call fcn.004025c0
push 0x41e618
push edi
mov ebx, eax
call fcn.004025c0
push 0x41e638
push edi
mov dword [ebp - 0x210], eax
call fcn.004025c0
push 0x41e658
push edi
mov dword [ebp - 0x214], eax
call fcn.004025c0
add esp, 0x28
mov edi, eax
call fcn.00401570
push edi
push dword [ebp - 0x214]
push dword [ebp - 0x210]
push ebx
push esi
push 0x41e670
test eax, eax
je 0x4024d5
call fcn.00405eea
add eax, 0x20
push eax
call fcn.004063ee
call fcn.00405eea
add eax, 0x20
jmp 0x4024eb
call fcn.00405eea
add eax, 0x40
push eax
call fcn.004063ee
call fcn.00405eea
add eax, 0x40
push eax
call fcn.00406079
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
Function at 0x402870
Capabilities:
List domain servers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
push str.Enumerating_domain..._n
mov dword [ebp - 0x118], eax
mov edi, 1
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x114], 0
call fcn.00402e20
add esp, 4
lea eax, [ebp - 0x114]
push eax
push 0
push 3
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 0x65
push 0
call sub.NETAPI32.dll_NetServerEnum
test eax, eax
je 0x40291d
cmp eax, 0xea
je 0x40291d
push eax
push str.A_system_error_has_occurred:__d_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
mov esi, dword [ebp - 0x10c]
add esp, 0xc
jmp 0x402998
mov esi, dword [ebp - 0x10c]
test esi, esi
je 0x4029a2
push ebx
xor ebx, ebx
cmp dword [ebp - 0x110], ebx
jbe 0x402997
test esi, esi
je 0x402991
push 0
push 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
push dword [esi + 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp + 8], 0
je 0x40296f
lea eax, [ebp - 0x108]
push eax
push str._s:_n
call fcn.00405193
add esp, 8
lea eax, [ebp - 0x108]
push eax
call dword [ebp - 0x118]
add esp, 4
neg eax
sbb eax, eax
inc ebx
and edi, eax
add esi, 0x18
cmp ebx, dword [ebp - 0x110]
jb 0x402932
mov esi, dword [ebp - 0x10c]
pop ebx
test esi, esi
je 0x4029a2
push esi
call sub.NETAPI32.dll_NetApiBufferFree
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00405755
mov esp, ebp
pop ebp
ret

Function at 0x402a30
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push str.BINRES
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x402a4f
xor al, al
pop edi
pop ebp
ret
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x41e7c0
push dword [ebp + 0xc]
mov ebx, eax
call fcn.00406cd1
mov esi, eax
add esp, 8
test esi, esi
jne 0x402a8d
pop esi
pop ebx
xor al, al
pop edi
pop ebp
ret
push esi
push edi
push 1
push ebx
call fcn.00406e3f
push esi
call fcn.00406a57
add esp, 0x14
mov al, 1
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x402b90
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0xf003f
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x402bad
pop ebx
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x110
lea ebx, [ebx]
cmp byte [ebp + 0x18], 0
mov eax, 0x10
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 0x14]
cmovne eax, ecx
push 0
push 3
push eax
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x402c1e
call edi
xor ecx, ecx
cmp eax, 0x431
sete cl
test ecx, ecx
jne 0x402c25
call edi
mov esi, eax
cmp esi, 0x34
je 0x402c25
cmp esi, 0x431
je 0x402c25
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x402c56
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp + 0x10]
push ebx
call fcn.004036c0
add esp, 8
test al, al
jne 0x402c54
call edi
mov esi, eax
mov ecx, 0x110
cmp esi, 0x20
je 0x402bc0
cmp esi, 0x3e5
jne 0x402c56
jmp 0x402bc0
xor esi, esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebx
pop ebp
ret

Function at 0x402c70
Capabilities:
Get file version info
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.004050ec
add esp, 4
mov edi, eax
lea eax, [ebp - 0x108]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov eax, 0x400
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x41e754
push edi
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x10c]
push 0x41e69c
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push edi
call fcn.00402ab0
mov esi, dword [ebp - 0x114]
push esi
push ebx
push eax
mov dword [ebp - 0x110], eax
call fcn.004021a0
add esp, 0x1c
test ebx, ebx
je 0x402d50
push esi
push ebx
push dword [ebp - 0x110]
call fcn.004017b0
add esp, 0xc
test eax, eax
je 0x402d6a
push edi
call fcn.004050b4
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00405755
mov esp, ebp
pop ebp
ret
push str.Eula_declined._n_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 8
push 1
call fcn.004050a0
int3
Function at 0x402d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
lea eax, [ebx - 0x834]
mov edi, 0x1300
cmp eax, 0x383
ja 0x402dc8
push 2
push esi
push str.netmsg.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
mov eax, 0x1b00
test esi, esi
cmovne edi, eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0x400
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x402e04
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x402e0f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4031c0
Capabilities:
Delete file
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x418], ebx
cmp byte [ebp + 8], 0
push edi
mov edi, dword [ebp + 0x14]
je 0x4032b8
push eax
push ebx
call fcn.004038a0
add esp, 8
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004053a7
add esp, 8
test eax, eax
jne 0x40326e
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0040747c
push edi
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call fcn.00405242
add esp, 0x18
jmp 0x403284
push edi
push ebx
lea eax, [ebp - 0x20c]
push str._sADMIN__s
push eax
call fcn.00405242
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4032b2
call ebx
cmp eax, 5
jne 0x4032b2
push 0x64
call edi
inc esi
cmp esi, 0xa
jb 0x403290
mov ebx, dword [ebp - 0x418]
cmp byte [0x4262e4], 0
je 0x4032e6
push ebx
lea eax, [ebp - 0x310]
push str._sIPC_
push eax
call fcn.00405242
add esp, 0xc
lea eax, [ebp - 0x310]
push 1
push 0
push eax
call sub.MPR.dll_WNetCancelConnection2A
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405755
mov esp, ebp
pop ebp
ret

Function at 0x403300
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov byte [ebp - 0x109], 0
cmp byte [esi], 0
jne 0x40333c
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebp - 0x108]
push str._sIPC_
push eax
call fcn.00405242
add esp, 0xc
lea eax, [ebp - 0x109]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x108]
push 0
push esi
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x12c]
push edi
movdqu xmmword [ebp - 0x12c], xmm0
push eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x120], 3
mov dword [ebp - 0x110], 0
call sub.MPR.dll_WNetAddConnection2A
movzx ecx, byte [0x4262e4]
mov edx, eax
test edx, edx
mov eax, 1
pop edi
cmove ecx, eax
xor eax, eax
test edx, edx
mov byte [0x4262e4], cl
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop esi
call fcn.00405755
mov esp, ebp
pop ebp
ret
Function at 0x403440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
push ebx
mov bl, byte [ebp + 0x14]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x314], edx
mov edx, dword [ebp + 0x2c]
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x31c], edx
push esi
mov esi, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 0xc]
test bl, bl
je 0x4034db
cmp byte [esi], 0
jne 0x4034db
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0040747c
push dword [ebp - 0x324]
mov byte [eax], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.00405242
add esp, 0x18
jmp 0x403503
push eax
push ecx
lea eax, [ebp - 0x108]
push str._sADMIN__s
push eax
call fcn.00405242
push dword [ebp - 0x31c]
push esi
push dword [ebp - 0x318]
call fcn.00403300
add esp, 0x1c
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x314]
call fcn.00402a30
add esp, 8
test al, al
jne 0x403657
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 8], al
jne 0x403536
call esi
cmp eax, 0x20
je 0x403657
call esi
cmp eax, 5
je 0x403550
cmp eax, 0x52e
je 0x403550
cmp eax, 0x3e7
je 0x403550
cmp eax, 0x35
jne 0x40356d
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x314]
call fcn.00402a30
add esp, 8
test al, al
jne 0x403657
call fcn.00402670
cmp byte [ebp + 0x30], 0
je 0x403611
test bl, bl
je 0x40358d
push dword [ebp - 0x320]
push str._rCouldnt_install__s_service:_n
jmp 0x403593
push edi
push str._rCouldnt_access__s:_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 0xc
call esi
mov esi, eax
push esi
call fcn.00402d90
add esp, 4
cmp esi, 0x43
je 0x4035de
cmp esi, 0x35
je 0x4035de
cmp esi, 0x4d0
je 0x4035cb
cmp esi, 0x4cf
jne 0x403611
test bl, bl
je 0x4035d6
push str._nMake_sure_that_file_and_print_sharing_services_are_enabled._n
jmp 0x4035e7
push edi
push str._nMake_sure_that_file_and_print_sharing_services_are_enabled_on__s._n
jmp 0x403600
test bl, bl
je 0x4035fa
push str._nMake_sure_that_the_admin__share_is_enabled._n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 8
jmp 0x403611
push edi
push str._nMake_sure_that_the_default_admin__share_is_enabled_on__s._n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 0xc
cmp byte [0x4262e4], 0
je 0x403644
push dword [ebp - 0x318]
lea eax, [ebp - 0x310]
push str._sIPC_
push eax
call fcn.00405242
add esp, 0xc
lea eax, [ebp - 0x310]
push 1
push 0
push eax
call sub.MPR.dll_WNetCancelConnection2A
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405755
mov esp, ebp
pop ebp
ret
Function at 0x4036c0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call ebx
mov ecx, dword [0x4262e8]
mov dword [ebp - 0x24], eax
test ecx, ecx
je 0x4036f5
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x4262e8], eax
test eax, eax
jne 0x40371c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x403738
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x403784
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push dword [0x4262e8]
mov edi, 1
call esi
test eax, eax
je 0x403784
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x403786
cmp eax, 1
je 0x403784
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xea60
ja 0x4037c0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push dword [0x4262e8]
call esi
test eax, eax
jne 0x403753
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x4262e8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
mov dword [0x4262e8], 0
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405755
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x41d
call ebx
xor edi, edi
jmp 0x40378c

Function at 0x4037e0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf01ff
push esi
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x403824
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x403881
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x40387e
lea esp, [esp]
cmp dword [ebp - 0x1c], 1
je 0x403880
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x24]
cmp eax, 0xea60
ja 0x403873
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x403850
jmp 0x40387e
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00405755
mov esp, ebp
pop ebp
ret
Function at 0x4038a0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0xf003f
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, dword [ebp + 0xc]
mov ebx, eax
push esi
push ebx
call fcn.004037e0
add esp, 8
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4038e5
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x404240
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4250d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 1
push 0xffffffffffffffff
push 0
push 0x4273e0
push 0x426518
push str.GETSIDSVC
push str.GETSIDSV.EXE
push str.GETSIDSV
push 0x41eaa4
push esi
push 1
call fcn.00402e60
add esp, 0x2c
test al, al
jne 0x404299
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
push edi
push esi
push str._rConnecting_with_psgetsid_service_on__s...
call fcn.00402e20
push esi
lea eax, [ebp - 0x108]
push str._spipegetsidsv
push eax
call fcn.00405242
add esp, 0x14
lea eax, [ebp - 0x108]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
call fcn.00402670
cmp edi, 0xffffffff
jne 0x40430a
push esi
push str._rError_establishing_communication_with_psgetsid_service_on__s:_n
call fcn.00405eea
add eax, 0x40
push eax
call fcn.0040622f
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d90
add esp, 4
jmp 0x40437e
push 0
lea eax, [ebp - 0x210]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404337
call fcn.00402670
push esi
push str._rError_communicating_with_psgetsid_service_on__s:_n
jmp 0x4042e8
push 0
lea eax, [ebp - 0x210]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40432a
cmp dword [ebp - 0x20c], 0
je 0x4043af
call fcn.00402670
push esi
push str._rError_getting_SID_for__s:_n
call fcn.00405193
push dword [ebp - 0x20c]
call fcn.00402d90
add esp, 0xc
push str.GETSIDSV.EXE
push str.GETSIDSV
push esi
push 1
call fcn.004031c0
push 0x41e9cc
call fcn.00402e20
add esp, 0x14
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405755
mov esp, ebp
pop ebp
ret
call fcn.00402670
push esi
push str._rSID_for__s:_n
call fcn.00405193
lea eax, [ebp - 0x208]
push eax
push str._s_n_n
call fcn.00405193
push str.GETSIDSV.EXE
push str.GETSIDSV
push esi
push 1
call fcn.004031c0
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.00405755
mov esp, ebp
pop ebp
ret