joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4067e8
xor eax, eax
test eax, eax
je 0x4067fb
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4067fb
xor ecx, ecx
jmp 0x4067fe
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406927
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x40695e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406938
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406933
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40698f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406971
pop edi
not eax
pop esi
ret 0xc

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x60412eb7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2fb86047
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x30b93c6f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x225238f9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401023
Capabilities:
Create service

Disassembly:
jmp 0x4022d0
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 2
je 0x4022f3
test esi, esi
je 0x4022f3
cmp esi, 3
je 0x4022f3
cmp esi, 4
je 0x4022f3
cmp esi, 1
je 0x4022f3
mov esi, 3
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x40232b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openscmanager_with_the_error_code__d
push 3
push 0x26
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push esi
push 0x110
push 0xf01ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x4023ce
push edi
push str._Successfully_installed_the_service___S
push 3
push 0x2f
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x3e8
push 2
call fcn.00408600
push edi
push str.SYSTEMCurrentControlSetServices_
mov esi, eax
push str._s_s
push esi
call fcn.004010c8
mov ecx, dword [esp + 0x34]
push 1
push ecx
push str.Description
push esi
push str.HKEY_LOCAL_MACHINE
call fcn.00401037
add esp, 0x2c
test esi, esi
je 0x4023c5
push esi
call fcn.00408fc0
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_install_the_service_with_the_error_code__d.
push 3
push 0x36
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x401037
Capabilities:
Set registry value

Disassembly:
jmp 0x402070
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
push eax
call fcn.004010e6
mov ebp, dword [esp + 0x30]
xor esi, esi
add esp, 4
cmp ebp, 4
mov ebx, eax
mov dword [esp + 0x14], esi
jne 0x4020ae
mov ecx, dword [esp + 0x28]
push ecx
mov edi, ebp
call fcn.0040e950
add esp, 4
mov dword [esp + 0x14], eax
lea esi, [esp + 0x14]
jmp 0x4020fd
cmp ebp, 1
je 0x4020db
cmp ebp, 2
je 0x4020db
cmp ebp, 7
jne 0x4020f9
mov esi, dword [esp + 0x28]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4020c6
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
jmp 0x4020fd
mov esi, dword [esp + 0x28]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4020e4
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
jmp 0x4020fd
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x402147
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_RegCreateKeyEx_with_the_error_code__d
push 3
push 0x61
push str..._registry_srcRegistryHandler.cpp
call dword [0x488308]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x24]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402150
sub eax, ebx
sar eax, 1
jne 0x402163
xor edx, edx
mov ecx, dword [esp + 0x10]
push edi
push esi
push ebp
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4021a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_RegSetValueEx_with_the_error_code__d
push 3
push 0x6b
push str..._registry_srcRegistryHandler.cpp
call dword [0x488308]
mov edx, dword [esp + 0x24]
add esp, 0x14
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40105a
Capabilities:
Delete service

Disassembly:
jmp 0x402450
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x402488
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openscmanager_with_the_error_code__d.
push 3
push 0x51
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
push edi
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x4024ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openservice_with_the_error_code__d
push 3
push 0x58
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402504
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_Uninstall_the_service_with_the_error_code__d.
push 3
push 0x60
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
ret
push str.Service_Successfully_Uninstalled
push 3
push 0x65
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x10
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40105f
Capabilities:
Create process on windows
Set current directory
Terminate process

Disassembly:
jmp 0x405eb0
sub esp, 0x58
push esi
xor eax, eax
push edi
push 0x44
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call fcn.0040ee40
mov edi, dword [esp + 0x70]
add esp, 0xc
push edi
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x3e8
push 2
call fcn.00408600
mov esi, eax
add esp, 8
test esi, esi
je 0x405f1f
mov eax, dword [esp + 0x68]
mov edx, esi
sub edx, eax
jmp 0x405f10
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x405f10
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push 0
push 0xc000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test esi, esi
mov edi, eax
je 0x405f4f
push esi
call fcn.00408fc0
add esp, 4
test edi, edi
pop edi
pop esi
jne 0x405f79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_Create_the_Process__with_error_code__d_.
push 3
push 0x28
push str...main_srcAgentUtil.cpp
call dword [0x488308]
add esp, 0x14
xor eax, eax
add esp, 0x58
ret
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x405fa1
push str.Time_out__so_return.
push 3
push 0x2e
push str...main_srcAgentUtil.cpp
call dword [0x488308]
add esp, 0x10
mov eax, 1
add esp, 0x58
ret
jge 0x405fa8
or eax, 0xffffffff
jmp 0x405fae
imul eax, eax, 0xea60
push eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x405fe8
push str.Terminate_process_and_return
push 3
push 0x35
push str...main_srcAgentUtil.cpp
call dword [0x488308]
mov ecx, dword [esp + 0x14]
add esp, 0x10
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add esp, 0x58
ret
mov eax, dword [esp + 4]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp]
push ecx
push str.ExitCode_is__d_and_return.
push 3
push 0x3f
push str...main_srcAgentUtil.cpp
call dword [0x488308]
mov eax, dword [esp + 0x14]
add esp, 0x14
cmp eax, 5
je 0x405f73
cmp eax, 0x669
je 0x406031
cmp eax, 0xbc2
je 0x406031
test eax, eax
jne 0x406036
mov eax, 1
add esp, 0x58
ret
Function at 0x40106e
Capabilities:
Delete file
Move file

Disassembly:
jmp 0x401720
sub esp, 0x50c
mov eax, dword [0x48e0d0]
xor eax, esp
mov dword [esp + 0x508], eax
push 0x5c
push 0x48fcf0
call fcn.00408600
add eax, 1
lea edx, [esp + 0x20c]
add esp, 8
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401750
push ebp
push esi
push edi
lea eax, [esp + 0x210]
push 0x476df4
push eax
call fcn.0040cff0
push 0x476df4
push 0
mov esi, eax
call fcn.0040cff0
mov edi, eax
push edi
xor ebp, ebp
push ebp
push esi
push str...log_
lea ecx, [esp + 0x334]
push str._s_s_d._s
push ecx
call fcn.0040cc80
lea edx, [esp + 0x33c]
push 0x476d2c
push edx
call fcn.0040c1b0
add esp, 0x30
test eax, eax
je 0x4017f2
push eax
add ebp, 1
call fcn.004077f0
push edi
push ebp
push esi
push str...log_
lea eax, [esp + 0x328]
push str._s_s_d._s
push eax
call fcn.0040cc80
lea ecx, [esp + 0x330]
push 0x476d2c
push ecx
call fcn.0040c1b0
add esp, 0x24
test eax, eax
jne 0x4017b6
test ebp, ebp
push ebx
mov ebx, ebp
jle 0x401856
lea esp, [esp]
push edi
lea eax, [ebx - 1]
push eax
push esi
push str...log_
lea edx, [esp + 0x24]
push str._s_s_d._s
push edx
mov dword [esp + 0x28], eax
call fcn.0040cc80
push edi
push ebx
push esi
push str...log_
lea eax, [esp + 0x13c]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x30
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, dword [esp + 0x10]
test ebx, ebx
jg 0x401800
push edi
push 0
push esi
push str...log_
lea eax, [esp + 0x24]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
push 0x48fcf0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x476dcc
push 0x48fcf0
call fcn.0040c1b0
add esp, 8
lea edx, [ebp + 1]
cmp edx, dword [0x48fcec]
mov dword [0x48fce8], eax
pop ebx
jne 0x4018c9
push edi
push ebp
push esi
push str...log_
lea eax, [esp + 0x20]
push str._s_s_d._s
push eax
call fcn.0040cc80
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x514]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040c270
add esp, 0x50c
ret
Function at 0x401073
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x401e80
sub esp, 0x10
mov eax, dword [esp + 0x14]
push eax
call fcn.004010e6
mov edx, dword [esp + 0x1c]
add esp, 4
lea ecx, [esp]
push ecx
push 1
push 0
push edx
push eax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_regopenkey_with_the_error__d.
push 3
push 0x1d
push str..._registry_srcRegistryHandler.cpp
call dword [0x488308]
add esp, 0x14
xor eax, eax
add esp, 0x10
ret
push ebx
push esi
push edi
push 0x104
push 2
call fcn.00408600
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
push edx
call ebx
test eax, eax
jne 0x401fc4
cmp dword [esp + 0x10], 0x104
ja 0x401fc4
cmp dword [esp + 0x14], 4
jne 0x401f71
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call ebx
test eax, eax
jne 0x401f85
cmp dword [esp + 0x10], 0x104
ja 0x401f85
mov ecx, dword [esp + 0x18]
push 0x14
push esi
push ecx
call fcn.0040e620
add esp, 0xc
mov edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x401f60
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_RegQueryValueEx_of_REG_DWORD_type_with_the_error__d_.
push 3
push 0x30
push str..._registry_srcRegistryHandler.cpp
call dword [0x488308]
add esp, 0x14
test esi, esi
je 0x401fb0
push esi
call fcn.00408fc0
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_RegQueryValueEx_with_the_error__d_.
push 3
push 0x24
push str..._registry_srcRegistryHandler.cpp
call dword [0x488308]
add esp, 0x14
test esi, esi
je 0x401fef
push esi
call fcn.00408fc0
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x401082
Capabilities:
Query service status
Start service

Disassembly:
jmp 0x4026c0
sub esp, 0x28
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x402701
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openscmanager_with_the_error_code__d.
push 3
push 0x9d
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
xor eax, eax
pop edi
add esp, 0x28
ret
push ebx
mov ebx, dword [esp + 0x34]
push esi
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x40274b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openservice_with_the_error_code__d.
push 3
push 0xa3
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x28
ret
lea eax, [esp + 0xc]
push eax
push 0x24
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x402793
push str.Failed_to_query_the_service.
push 1
push 0xae
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x28
ret
cmp dword [esp + 0x14], 4
jne 0x4027b7
push ebx
push str.The_Service____S___is_already_running
push 3
push 0xb5
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
jmp 0x402816
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4027fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_start_the_service__with_the_error_code__d.
push 3
push 0xbd
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x28
ret
push str.Successfully_started_the_service.
push 3
push 0xc2
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x28
ret
Function at 0x40109b
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4060a0
sub esp, 0x23c
mov eax, dword [0x48e0d0]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x250]
xor ebx, ebx
test edi, edi
mov dword [esp + 0x14], ebx
je 0x406234
push 0x47ad9c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov esi, dword [sym.agentmonitor.exe_Log]
je 0x406110
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40610a
push str.WTSGetActiveConsoleSessionId_Function_not_present_in_Kernel32.lib.
push 3
push 0x84
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x10
jmp 0x406112
call eax
mov ebx, eax
jmp 0x406112
xor ebx, ebx
push edi
push str.GetProcessID:Given_Process_Name_:__S
push 3
push 0x90
push str...main_srcAgentUtil.cpp
call esi
push ebx
push str.Active_console_sessionid_is_:__d
push 3
push 0x91
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x28
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x406173
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed_with_the_Error_:_d
push 3
push 0x95
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x14
xor eax, eax
jmp 0x406238
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x24], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40616c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x40]
push edi
push edx
call fcn.0040f4d0
add esp, 8
test eax, eax
jne 0x406213
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4061fa
mov edx, dword [esp + 0x10]
push edx
push edi
push str.Session_ID_of__S_is__d_n
push 3
push 0xa7
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x18
cmp dword [esp + 0x10], ebx
je 0x40622c
push edi
push str.session_id_of__S_is_does_not_match_with_active_console_session_id
push 3
push 0xb0
push str...main_srcAgentUtil.cpp
call esi
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
jmp 0x406210
call ebp
push eax
push str.Problem_in_ProcessIdToSessionId_...__:__d.
push 3
push 0xb6
push str...main_srcAgentUtil.cpp
call esi
add esp, 0x14
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406190
jmp 0x406234
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x406238
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040c270
add esp, 0x23c
ret
Function at 0x4010a5
Capabilities:
Create directory

Disassembly:
jmp 0x401620
cmp dword [0x48fdf8], 0
jne 0x4016e3
push esi
mov esi, dword [esp + 8]
push 0x5c
push esi
call fcn.0040c4f0
add esp, 8
test eax, eax
je 0x40165e
mov edx, 0x48fcf0
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401650
jmp 0x401676
push esi
push str...log_
push 0x476dd0
push 0x48fcf0
call fcn.0040cc80
add esp, 0x10
push 0x476dcc
push 0x48fcf0
call fcn.0040c1b0
add esp, 8
test eax, eax
mov dword [0x48fce8], eax
pop esi
jne 0x4016b5
push eax
push str...log_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x476dcc
push 0x48fcf0
call fcn.0040c1b0
add esp, 8
mov dword [0x48fce8], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
imul ecx, ecx, 0xf4240
mov edx, dword [esp + 0x10]
push 0x48fdf0
mov dword [0x48fce0], eax
mov dword [0x48fce4], ecx
mov dword [0x48fcec], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
ret

Function at 0x4010cd
Capabilities:
Terminate process

Disassembly:
jmp 0x406fe0
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x407089
push ebx
push edi
push esi
call fcn.0040109b
mov ebx, dword [sym.agentmonitor.exe_Log]
mov edi, eax
push edi
push esi
push str.processid_of__S_is__d
push 3
push 0x59
push str...main_srcAgentUtil.cpp
call ebx
add esp, 0x1c
test edi, edi
je 0x407087
push edi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x40706c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x407054
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.failed_to_terminate__S_with_the_Error_:_d
push 3
push 0x61
push str...main_srcAgentUtil.cpp
call ebx
add esp, 0x18
pop edi
pop ebx
pop esi
ret
push esi
push str.EXE____S_was_Terminated.
push 3
push 0x65
push str...main_srcAgentUtil.cpp
call ebx
add esp, 0x14
pop edi
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Could_not_get_the_handle_for_the_process_:__S._Failed_in_OpenProcess_with_the_Error_:_d
push 3
push 0x6a
push str...main_srcAgentUtil.cpp
call ebx
add esp, 0x18
pop edi
pop ebx
pop esi
ret
Function at 0x40110e
Capabilities:
Stop service

Disassembly:
jmp 0x402570
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
test esi, esi
push edi
je 0x40266c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4025bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openscmanager_with_the_error_code__d.
push 3
push 0x7a
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4025ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_openservice_with_the_error_code__d.
push 3
push 0x81
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402646
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_stop_the_service_with_the_error_code__d.
push 1
push 0x88
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
push str.Successfully_stopped_the_servics
push 3
push 0x8d
push str..._service_srcServiceHandler.cpp
call dword [0x488308]
add esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret