joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401020
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
movzx eax, byte [0x41cec4]
test eax, eax
je 0x40116c
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0040b510
add esp, 0xc
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0040b510
add esp, 0xc
movzx edx, word [ebp - 0x210]
test edx, edx
jne 0x4010cc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jl 0x4010cc
push str.HitmanProLogsScheduler.log
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x418]
test eax, eax
je 0x40116c
push 0x41cea8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xffffffff
je 0x401161
push 2
push 0
push 0
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401154
mov ecx, dword [ebp - 0x424]
cmp ecx, dword [ebp + 0xc]
jne 0x401154
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41cea8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret

Function at 0x401250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREHitmanPro
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012b7
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push str.SchedulerWriteLog
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4012ad
cmp dword [ebp - 0xc], 1
jne 0x4012ad
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x401340
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4013c6
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4013bc
push 0x417cfc
call fcn.00401220
add esp, 4
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret

Function at 0x4013e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00401000
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4014d8
mov dword [ebp - 0x10], 0
jmp 0x401420
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jge 0x4014d8
push str._user
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00404b4c
add esp, 8
test eax, eax
jne 0x401450
mov byte [ebp - 0xa], 0
jmp 0x4014d3
push str._install
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00404b4c
add esp, 8
test eax, eax
jne 0x401494
call fcn.004041b0
movzx ecx, al
test ecx, ecx
je 0x40148b
push 0x40
push 0x417d34
push str.Service_successfully_installed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40151a
push str._uninstall
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00404b4c
add esp, 8
test eax, eax
jne 0x4014d3
call fcn.00404300
movzx edx, al
test edx, edx
je 0x4014cf
push 0x40
push 0x417d34
push str.Service_successfully_uninstalled.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40151a
jmp 0x401417
movzx eax, byte [ebp - 0xa]
test eax, eax
je 0x4014e7
call fcn.00404180
jmp 0x401518
call fcn.00401340
movzx ecx, al
test ecx, ecx
jne 0x401502
push str.User_does_not_have_admin_rights_r_n
call fcn.00401180
add esp, 4
jmp 0x401518
call fcn.00402df0
movzx edx, al
test edx, edx
je 0x401518
call fcn.00402ee0
call fcn.00402ec0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401f40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415a3b
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb8], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SOFTWAREHitmanPro
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40204f
mov dword [ebp - 0x9c], 0x80
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x94]
push edx
push 0
push 0
push 0x417f18
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x98], 0
jne 0x40204f
lea ecx, [ebp - 0xb4]
call fcn.00401660
mov dword [ebp - 4], 0
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00401d00
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40203d
lea edx, [ebp - 0xb4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004016a0
mov eax, dword [ebp - 0xb8]
or eax, 1
mov dword [ebp - 0xb8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.004017b0
mov eax, dword [ebp + 8]
jmp 0x402075
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.004017b0
push 0
push 0x24c85a5e
push 0xd1c018f0
mov ecx, dword [ebp + 8]
call fcn.004016e0
mov ecx, dword [ebp - 0xb8]
or ecx, 1
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret
Function at 0x402410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [0x41cef8], ax
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402500
lea edx, [ebp - 4]
push edx
push 1
push 0
push str.HitmanPro38
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4024f6
mov dword [ebp - 0x414], 0x400
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x410]
push edx
push 0
push 0
push str.UninstallString
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4024ec
movzx ecx, word [ebp - 0x410]
cmp ecx, 0x22
jne 0x4024ec
push 0x22
lea edx, [ebp - 0x40e]
push edx
call fcn.00403860
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x4024d3
xor eax, eax
mov ecx, dword [ebp - 0x418]
mov word [ecx], ax
lea edx, [ebp - 0x40e]
push edx
push 0x200
push 0x41cef8
call fcn.00404e8e
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, word [0x41cef8]
test edx, edx
jne 0x402511
xor eax, eax
jmp 0x402516
mov eax, 0x41cef8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret
Function at 0x403880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREHitmanPro
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403908
mov dword [ebp - 0x214], 0x200
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push str.SchedulerWhen
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4038fe
push str.startup
lea ecx, [ebp - 0x210]
push ecx
call fcn.00404b4c
add esp, 8
test eax, eax
jne 0x4038fe
mov byte [ebp - 5], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret

Function at 0x403920
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x201eb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403960
push 0x418438
call fcn.00401220
add esp, 4
jmp 0x403a2a
lea ecx, [ebp - 8]
push ecx
push 1
push 1
push 0
push 0x2000000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40398f
push str.DuplicateHandleEx
call fcn.00401220
add esp, 4
jmp 0x403a2a
push 4
lea eax, [ebp + 8]
push eax
push 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4039b4
push 0x418460
call fcn.00401220
add esp, 4
jmp 0x403a2a
lea edx, [ebp - 0x10]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4039d8
push str.LookupPrivilegeValue
call fcn.00401220
add esp, 4
jmp 0x403a2a
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x403a1b
push 0x4184b0
call fcn.00401220
add esp, 4
jmp 0x403a2a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x403a4c
cmp dword [ebp - 4], 0
je 0x403a3a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x403a4a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403a50
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x403a8f
push 0x4184c8
call fcn.00401220
add esp, 4
xor eax, eax
jmp 0x403bdc
push 0x114
push 0
lea edx, [ebp - 0x130]
push edx
call fcn.0040b510
add esp, 0xc
mov dword [ebp - 0x130], 0x114
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x403acf
push str.GetVersionEx
call fcn.00401220
add esp, 4
jmp 0x403b29
cmp dword [ebp - 0x12c], 6
jb 0x403b29
lea ecx, [ebp - 0x138]
push ecx
push 4
lea edx, [ebp - 0x134]
push edx
push 0x13
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x403b16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x520
jne 0x403b07
jmp 0x403b14
push 0x4184ec
call fcn.00401220
add esp, 4
jmp 0x403b29
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x403b4b
push 0x418500
call fcn.00401220
add esp, 4
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x403baf
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x403ba5
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x18], 0
je 0x403bc0
mov eax, dword [ebp - 0x10]
jmp 0x403bdc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403920
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret
Function at 0x403bf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], 0
call fcn.004012c0
mov eax, dword [ebp + 8]
push eax
call fcn.00403400
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x403c35
mov edx, dword [ebp + 8]
push edx
push str.Scheduler_already_running_in_session__u_r_n
call fcn.00401180
add esp, 8
jmp 0x403d70
mov eax, dword [ebp + 8]
push eax
call fcn.00403a50
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403d70
push 0x44
push 0
lea ecx, [ebp - 0x868]
push ecx
call fcn.0040b510
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x820], edx
mov dword [ebp - 0x81c], edx
mov dword [ebp - 0x818], edx
mov dword [ebp - 0x814], edx
mov dword [ebp - 0x868], 0x44
mov dword [ebp - 0x860], str.winsta0Default
push 0x104
lea eax, [ebp - 0xa70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x403cb9
push str.GetModuleFileName
call fcn.00401220
add esp, 4
jmp 0x403d66
lea ecx, [ebp - 0xa70]
push ecx
push str.__s___user
push 0x400
lea edx, [ebp - 0x810]
push edx
call fcn.00404efd
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
push str.CreateProcessAsUser:__ws_r_n
call fcn.00401180
add esp, 8
lea ecx, [ebp - 0x820]
push ecx
lea edx, [ebp - 0x868]
push edx
push 0
push 0
push 0x30
push 1
push 0
push 0
lea eax, [ebp - 0x810]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x403d2d
push str.CreateProcessAsUser
call fcn.00401220
add esp, 4
jmp 0x403d66
mov edx, dword [ebp - 0x818]
push edx
lea eax, [ebp - 0xa70]
push eax
push str._ws_started_with_PID__u_r_n
call fcn.00401180
add esp, 0xc
mov ecx, dword [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret
Function at 0x4041b0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x41b194]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x211], 0
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4042e4
lea ecx, [ebp - 0x420]
push ecx
push str.__s_
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.00404efd
add esp, 0x10
push 0xf003f
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x404239
push str.OpenSCManager
call fcn.00401220
add esp, 4
jmp 0x4042e4
push 0
push 0
push 0
push 0
push str.PNP_TDI
lea eax, [ebp - 0x210]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x418764
push str.HitmanProScheduler
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x4042a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x404294
mov byte [ebp - 0x211], 1
jmp 0x4042a1
push str.CreateService
call fcn.00401220
add esp, 4
jmp 0x4042d7
mov dword [ebp - 0x42c], str.HitmanPro_Scheduler_controls_scheduled_scans
lea edx, [ebp - 0x42c]
push edx
push 1
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [ebp - 0x211], 1
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x211]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404566
mov esp, ebp
pop ebp
ret

Function at 0x404300
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 9], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4043b9
push 0x10020
push str.HitmanProScheduler
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404356
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x404354
mov byte [ebp - 9], 1
jmp 0x4043af
lea ecx, [ebp - 0x28]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x404384
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x404384
push 0x4187fc
call fcn.00401220
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x404398
mov byte [ebp - 9], 1
jmp 0x4043a5
push 0x41880c
call fcn.00401220
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4043c0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 9], 0
call fcn.004012c0
push str.RestartService_r_n
call fcn.00401180
add esp, 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404406
push str.OpenSCManager_r_n
call fcn.00401220
add esp, 4
jmp 0x40449b
push 0x10
push str.HitmanProScheduler
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40442f
push str.OpenService
call fcn.00401220
add esp, 4
jmp 0x404491
mov dword [ebp - 0x10], str.endsession
xor ecx, ecx
cmp dword [ebp + 8], 0
setne cl
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
lea eax, [ebp - 0x10]
and edx, eax
push edx
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x404483
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x404474
mov byte [ebp - 9], 1
jmp 0x404481
push str.StartService
call fcn.00401220
add esp, 4
jmp 0x404487
mov byte [ebp - 9], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4044b0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 9], 0
call fcn.004012c0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404552
push 0x20
push str.HitmanProScheduler
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x404504
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x404502
mov byte [ebp - 9], 1
jmp 0x404548
lea ecx, [ebp - 0x28]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40453a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x404534
push 0x4187fc
call fcn.00401220
add esp, 4
jmp 0x404538
mov byte [ebp - 9], 1
jmp 0x40453e
mov byte [ebp - 9], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x404566
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b194]
jne 0x404570
repz ret
jmp fcn.00405148
Function at 0x40c135
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004090c4
and dword [ebp - 4], 0
cmp dword [0x41cd80], 0
mov ebx, eax
jne 0x40c1e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c297
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416b94
push edi
call esi
test eax, eax
je 0x40c297
push eax
call fcn.00409052
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41cd80], eax
call esi
push eax
call fcn.00409052
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41cd84], eax
call esi
push eax
call fcn.00409052
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41cd88], eax
call esi
push eax
call fcn.00409052
pop ecx
mov dword [0x41cd90], eax
test eax, eax
je 0x40c1e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409052
pop ecx
mov dword [0x41cd8c], eax
mov eax, dword [0x41cd8c]
cmp eax, ebx
je 0x40c23e
cmp dword [0x41cd90], ebx
je 0x40c23e
push eax
call fcn.004090cd
push dword [0x41cd90]
mov esi, eax
call fcn.004090cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c23e
test edi, edi
je 0x40c23e
call esi
test eax, eax
je 0x40c235
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c235
test byte [ebp - 0xc], 1
jne 0x40c23e
or dword [ebp + 0x10], 0x200000
jmp 0x40c277
mov eax, dword [0x41cd84]
cmp eax, ebx
je 0x40c277
push eax
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c277
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c277
mov eax, dword [0x41cd88]
cmp eax, ebx
je 0x40c277
push eax
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c277
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41cd80]
call fcn.004090cd
pop ecx
test eax, eax
je 0x40c297
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c299
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cfcc
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40d007
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40cfee
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40cfff
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40d009
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40cfe4
xor eax, eax
pop edi
pop esi
ret