joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4231a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push esi
call fcn.00423c70
push eax
push dword [ebp + 8]
call fcn.004235a0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x4231cb
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 0xffffffff
jne 0x4231e9
mov edi, edx
lea ebx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4231e0
sub edi, ebx
push ecx
push edi
push 1
push edx
call fcn.00548884
mov ebx, eax
add esp, 0x10
cmp ebx, edi
je 0x423292
push esi
call fcn.00423a30
add esp, 4
test eax, 0x1000
jne 0x423271
push esi
call fcn.00423a30
and eax, 0xf
add esp, 4
cmp al, 6
ja 0x423292
push esi
call fcn.00423a30
and eax, 0xf
add esp, 4
cmp al, 5
jbe 0x423271
push esi
call fcn.00423a30
add esp, 4
test eax, 0x1300
jne 0x423271
push esi
call fcn.00423a30
push dword [ebp + 0x14]
mov esi, eax
and esi, 0xc90000
or esi, 0x360000
shr esi, 0x10
call fcn.00423a30
and eax, 0xf
add esp, 8
cmp dword [esi*4 + 0x601b40], eax
jl 0x423292
mov esi, dword [ebp + 0x14]
push ebx
push edi
push dword [ebp + 8]
push str.failed_fwrite__s__sz__d__returned__d
push esi
call fcn.00423a30
add esp, 4
or eax, 0x360000
push eax
call fcn.004241a0
add esp, 0x14
push dword [ebp - 4]
call fcn.005484a6
add esp, 4
sub ebx, edi
neg ebx
sbb ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423330
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x10000
call fcn.005414d5
mov esi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push esi
or edi, 0xffffffff
call fcn.0053c550
add esp, 0xc
test eax, eax
jne 0x423413
push 0x56e9d4
push esi
call fcn.0053bdf0
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x423413
push 0x56eb48
push dword [ebp + 0xc]
call fcn.0053bdf0
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4233f8
mov edi, dword [ebp - 0x2c]
mov ecx, edi
mov ebx, dword [ebp - 0x28]
or ecx, ebx
je 0x4233ee
nop
test ebx, ebx
jl 0x4233b5
jg 0x4233ae
cmp edi, 0x10000
jbe 0x4233b5
mov esi, 0x10000
jmp 0x4233b7
mov esi, edi
push dword [ebp - 8]
push esi
push 1
push dword [ebp - 4]
call fcn.00541e3c
add esp, 0x10
cmp eax, esi
jne 0x4233f2
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.00548884
add esp, 0x10
cmp eax, esi
jne 0x4233f2
mov eax, esi
cdq
sub edi, eax
mov eax, edi
sbb ebx, edx
or eax, ebx
jne 0x4233a0
xor edi, edi
jmp 0x4233f5
or edi, 0xffffffff
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call fcn.005484a6
mov eax, dword [ebp - 0xc]
add esp, 4
test eax, eax
je 0x423413
push eax
call fcn.005484a6
add esp, 4
push ebx
call fcn.005414d0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push fcn.004221a0
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420780
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [0x5fd8bc]
test eax, eax
jne 0x423884
push esi
push str.TEMP
call fcn.0053b460
add esp, 4
test eax, eax
jne 0x42381a
push 0x56ea10
call fcn.0053b460
add esp, 4
test eax, eax
jne 0x42381a
push dword [ebp - 4]
call fcn.00422210
mov eax, dword [ebp - 4]
add esp, 4
push dword [eax]
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x4237d0
push esi
push dword [ebp - 4]
call fcn.00422230
mov ecx, dword [ebp - 4]
add esp, 8
push dword [ecx]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp - 4]
push dword [eax]
push 0x5fd8bc
call fcn.004219a0
jmp 0x423825
push 0x56ea14
call fcn.0053b460
add esp, 4
test eax, eax
je 0x423888
mov dl, byte [eax]
movzx ecx, dl
test byte [ecx*2 + 0x5dfbb8], 4
je 0x423888
cmp byte [eax + 1], 0x3a
jne 0x423888
movsx eax, dl
push eax
push str._c:_Temp
push 0x5fd8bc
call fcn.004218d0
add esp, 0xc
jmp 0x423828
push eax
push 0x5fd8bc
call fcn.00421840
add esp, 8
lea eax, [ebp - 0x3c]
push eax
push dword [0x5fd8bc]
call fcn.0053c550
add esp, 8
pop esi
test eax, eax
jne 0x423853
movzx eax, word [ebp - 0x36]
test eax, eax
je 0x423853
and eax, 0xf000
cmp eax, 0x4000
je 0x42387f
push dword [0x5fd8bc]
push str.creating_temp_directory__s
push 0x360004
call fcn.004241a0
push 0x1ff
push dword [0x5fd8bc]
call fcn.0053b9d0
add esp, 0x14
test eax, eax
jne 0x423897
mov eax, dword [0x5fd8bc]
mov esp, ebp
pop ebp
ret
push str.failed_to_get_temp_directory
push 0x360000
call fcn.00424700
push str.failed_to_create_temp_directory
push 0x360000
call fcn.00424700
int3
Function at 0x424b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 2
call fcn.00541bde
mov edi, dword [ebp + 0x10]
add esp, 4
mov ecx, edi
mov ebx, edi
sar ecx, 0x10
and ebx, 0xf
movzx ecx, cl
mov esi, eax
lea eax, [ebp - 0x100]
mov dword [ebp + 0x10], ecx
cmp dword [ecx*4 + 0x601b40], ebx
jge 0x424b86
test edi, 0x300
je 0x424c83
cmp dword [0x601f40], 0
je 0x424bb2
call fcn.00424f80
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00537ca0
mov cx, word [0x56ebc8]
add esp, 8
mov word [eax], cx
inc eax
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx + ecx*2]
push dword [ecx*4 + 0x5edc5c]
push eax
call fcn.00537ca0
movzx ecx, word [0x56ebc8]
mov word [eax], cx
inc eax
push dword [ebx*4 + 0x5ed040]
push eax
call fcn.00537ca0
movzx ecx, word [0x56ebc4]
mov ebx, eax
mov word [ebx], cx
mov cl, byte [0x56ebc6]
mov byte [ebx + 2], cl
add ebx, 2
lea ecx, [ebp - 1]
sub ecx, ebx
push ecx
push dword [ebp + 0xc]
push ebx
call fcn.00537b60
add esp, 0x1c
lea ecx, [ebp - 1]
push esi
push 1
cmp eax, ecx
jae 0x424c28
mov byte [eax], 0xa
lea ecx, [ebp - 0x100]
sub eax, ecx
inc eax
push eax
mov eax, ecx
push eax
call fcn.00548884
add esp, 0x10
jmp 0x424c4e
lea eax, [ebp - 0x100]
sub ebx, eax
push ebx
push eax
call fcn.00548884
push esi
push dword [ebp + 0xc]
call fcn.00547f61
push esi
push 0x56e890
call fcn.00547f61
add esp, 0x20
mov eax, dword [0x5ed874]
cmp eax, 0xffffffff
jne 0x424c6c
push esi
call fcn.0053b3e0
push eax
call fcn.0053b960
add esp, 8
mov dword [0x5ed874], eax
test eax, eax
mov ecx, 0x2000
cmovne edi, ecx
test ecx, edi
je 0x424c83
push esi
call fcn.00548a6a
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425d50
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
test esi, esi
je 0x425d73
mov ebx, esi
jmp 0x425d7a
call fcn.0053b950
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
push str.SeDebugPrivilege
mov dword [ebp + 0x10], 0
call fcn.004439c0
add esp, 8
test eax, eax
je 0x425db7
push str.failed_privilege_enable
push 0x360003
call fcn.004241a0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x425dfa
push ebx
push 0
push 0xfffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call fcn.0053b3a0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x425df3
push str.failed_OpenProcess:__m
push 0x360003
call fcn.004241a0
add esp, 8
or ebx, 0xffffffff
jmp 0x425eb1
mov dword [ebp + 0x10], 1
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push edi
call fcn.00443860
mov ecx, eax
add esp, 0x1c
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x425e3a
push edi
push str.failed_z_CreateFile__s:__m
push 0x360003
call fcn.004241a0
add esp, 0xc
or ebx, 0xffffffff
jmp 0x425eb0
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0x20], eax
test esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
cmovne eax, edx
mov dword [ebp - 0x14], 0x426520
cmp dword [ebp + 0x14], 0
mov edx, 7
push eax
mov eax, 0x11a0
mov dword [ebp - 0x10], 0
cmove eax, edx
push eax
push ecx
push ebx
push dword [ebp - 4]
call dword [0x5fd9f4]
push eax
call fcn.0053b370
xor ebx, ebx
add esp, 4
test eax, eax
sete bl
test eax, eax
jne 0x425eb0
push edi
push str.failed_MiniDumpWriteDump__s:__m
push 0x360003
call fcn.004241a0
add esp, 0xc
pop edi
lea eax, [ebp - 0x30]
push eax
call fcn.00443a20
lea eax, [ebp - 8]
push eax
call fcn.00443830
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x425ed8
lea eax, [ebp - 4]
push eax
call fcn.00443830
add esp, 4
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425fd0
Capabilities:
Acquire debug privileges
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x426000
push eax
call fcn.005414d0
add esp, 4
mov dword [edi], 0
lea eax, [ebp - 0x34]
push eax
push str.SeDebugPrivilege
call fcn.004439c0
add esp, 8
test eax, eax
jne 0x426137
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x426028
call fcn.0053b950
mov ebx, eax
push ebx
call fcn.00427270
add esp, 4
test eax, eax
jne 0x426121
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
test eax, eax
je 0x426136
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push ecx
push eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x426121
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x1c], eax
jne 0x426081
call fcn.0053b950
cmp ebx, eax
jne 0x426081
mov esi, 1
jmp 0x426083
xor esi, esi
cmp dword [ebp - 0x18], ebx
jne 0x4260fe
push dword [ebp - 0x1c]
push str.Thread__ld:_n
push edi
call fcn.00421580
add esp, 0xc
push dword [ebp - 0x1c]
push 0
push 0xfffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push eax
call fcn.0053b3a0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x4260c9
push str.Failed_opening_the_thread:__m_n
push edi
call fcn.00421580
add esp, 8
jmp 0x4260fe
test esi, esi
je 0x42613e
lea eax, [ebp - 0x300]
push eax
call dword [0x5fda08]
push dword [ebp + 0x10]
lea eax, [ebp - 0x300]
push dword [ebp - 4]
push ebx
push eax
push edi
call fcn.004262e0
add esp, 0x14
test esi, esi
jne 0x4260fe
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00443830
add esp, 4
test esi, esi
jne 0x426066
pop esi
lea eax, [ebp - 0x34]
push eax
call fcn.00443a20
lea eax, [ebp - 8]
push eax
call fcn.00443830
add esp, 8
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push eax
call fcn.0053b370
add esp, 4
cmp eax, 0xffffffff
jne 0x426163
push str.Failed_to_suspend_the_thread:__m_n
push edi
call fcn.00421580
add esp, 8
jmp 0x4260fe
lea eax, [ebp - 0x300]
mov dword [ebp - 0x300], 0x1001f
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x4260da
push str.Failed_getting_thread_context:__m_n
push edi
call fcn.00421580
add esp, 8
jmp 0x4260f5
Function at 0x426ba0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
xor ebx, ebx
lea eax, [ebp - 0x44c]
push 0x428
push ebx
push eax
mov dword [ebp - 0xc], ebx
call fcn.0053f280
add esp, 0xc
mov dword [ebp - 0x44c], 0x428
push dword [ebp + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ecx, eax
xor edx, edx
cmp ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
cmove eax, edx
test eax, eax
je 0x426d88
lea eax, [ebp - 0x44c]
push eax
push ecx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x426d88
push esi
lea esi, [ebp + 4]
add esi, 0xfffffffc
push edi
mov dword [ebp - 0x24], esi
mov edi, 0x41c64e6d
lea eax, [ebp - 0x22c]
push eax
push esi
call fcn.00420c80
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
push esi
call fcn.00420c80
mov esi, dword [ebp - 0x438]
push 1
push 0xc
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], esi
call fcn.005414c5
push dword [ebp - 4]
mov ebx, dword [0x5fda3c]
mov dword [ebp - 0x20], eax
mov eax, esi
mul edi
mov edi, eax
mov esi, edx
call fcn.00422540
mov ecx, dword [ebx + 4]
sub edi, esi
mov edx, eax
add esp, 0x1c
mov eax, dword [ebx + 8]
xor edx, edi
mov edi, dword [ebp - 8]
and ecx, edx
mov dword [ebp - 0x14], edx
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x426cd3
mov ebx, dword [ebp - 4]
nop dword [eax + eax]
cmp edx, dword [esi]
jne 0x426ccc
cmp edi, dword [esi + 0x10]
jne 0x426ccc
mov eax, dword [esi + 0x1c]
mov ecx, ebx
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x426cc0
test dl, dl
je 0x426cbc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x426cc0
add ecx, 2
add eax, 2
test dl, dl
jne 0x426ca0
xor eax, eax
jmp 0x426cc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x426d3c
mov edx, dword [ebp - 0x14]
mov esi, dword [esi + 4]
test esi, esi
jne 0x426c90
push 1
push 0x30
call fcn.005414c5
push dword [ebp - 0x1c]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], 0
call fcn.00421840
push dword [ebp - 4]
lea eax, [esi + 0x1c]
push eax
call fcn.00421840
mov ecx, dword [0x5ed884]
push 0
push esi
mov dword [esi + 0xc], ecx
lea eax, [ecx + 4]
mov dword [0x5ed884], eax
call fcn.00426db0
push esi
push dword [0x5fda3c]
call fcn.004268e0
mov eax, dword [0x5fda3c]
add esp, 0x28
cmp dword [eax + 0xc], 0x3e8
jge 0x426d9b
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov dword [ecx + 8], esi
test ebx, ebx
je 0x426d59
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov dword [ebx + 4], ecx
mov eax, dword [ecx + 4]
mov dword [eax], ecx
jmp 0x426d61
mov ebx, ecx
mov dword [ecx + 4], ecx
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x44c]
mov dword [ecx], 0
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_Module32NextW
mov esi, dword [ebp - 0x24]
mov edi, 0x41c64e6d
test eax, eax
jne 0x426c12
pop edi
pop esi
lea eax, [ebp - 0x10]
push eax
call fcn.00443830
add esp, 4
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push str.using_more_than_1000_module_entries
push 0x36
call fcn.00420560
int3
Function at 0x428960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x428590
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420780
lea ecx, [ebp + 0xc]
mov dword [ebp - 0xc], eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 8], 0xffffffff
push eax
mov dword [ebp - 4], 0
call fcn.004218f0
add esp, 0x18
cmp dword [0x601c18], 6
jl 0x4289bc
mov eax, dword [ebp - 0xc]
push dword [eax]
push str.sys_exec__s_
push 0x360006
call fcn.004241a0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.00428ad0
add esp, 4
test eax, eax
jns 0x4289f6
cmp dword [0x601c18], 6
jl 0x428ab0
mov eax, dword [ebp - 0xc]
push dword [eax]
push str.failed_sys_exec_bg__s_
push 0x360006
call fcn.004241a0
add esp, 0xc
jmp 0x428ab0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.00429bd0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ebx, eax
mov eax, edx
mov ecx, ebx
mov dword [ebp - 0x10], eax
mov esi, eax
mov eax, dword [0x5fda4c]
test eax, eax
je 0x428a47
imul eax, eax, 0x3e8
cdq
sub eax, ecx
sbb edx, esi
add eax, ebx
adc edx, dword [ebp - 0x10]
test edx, edx
ja 0x428a42
jb 0x428a35
test eax, eax
jne 0x428a42
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
jmp 0x428a51
mov dword [ebp - 0x14], edx
jmp 0x428a51
or eax, 0xffffffff
mov dword [ebp - 0x14], 0
push 1
push eax
push dword [ebp - 4]
call edi
cmp eax, 0xc0
jne 0x428a6b
call fcn.00429bd0
mov ecx, eax
mov esi, edx
jmp 0x428a12
pop edi
pop esi
pop ebx
test eax, eax
je 0x428a86
push 0x16
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], 0xfffffff7
jmp 0x428aa4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 8]
mov ecx, 0xffffffea
cmp eax, 3
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.00443830
add esp, 4
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
mov dword [ecx + 0x15f8], eax
mov esp, ebp
pop ebp
ret

Function at 0x428fa0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
neg eax
sbb eax, eax
inc eax
pop ebp
ret

Function at 0x429010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0x14
call fcn.005414c5
mov ecx, dword [ebp + 8]
mov esi, eax
push 0
push 0
push esi
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
push 0x429190
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x10]
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 2
call fcn.00549713
add esp, 0x20
mov dword [esi], eax
pop esi
test eax, eax
je 0x429058
xor eax, eax
pop ebp
ret
push str.failed_create_thread:__m
push 0x360000
call fcn.00424700
int3
Function at 0x430ef0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
or esi, 0xffffffff
cmp dword [0x5fdc84], 0
push edi
je 0x430f92
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00420e40
add esp, 8
push 0x10000
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b3a0
mov edi, eax
add esp, 4
test edi, edi
je 0x430f92
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x430f64
push dword [ebp + 8]
push str.Failed_deleting_service__s:__m
push 0x550003
call fcn.004241a0
add esp, 0xc
jmp 0x430f66
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x430f8c
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.004241a0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 0x28f0]
test eax, eax
jne 0x430fa9
call fcn.005414b2
mov eax, dword [eax]
sub eax, 0x424
neg eax
pop edi
sbb eax, eax
pop esi
pop ebp
ret

Function at 0x430fc0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
cmp dword [0x5fdc84], esi
je 0x431074
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00420e40
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b3a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x431074
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431042
push edi
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.004241a0
add esp, 0xc
test eax, eax
jne 0x431045
mov esi, dword [ebp - 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431087
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.004241a0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.service__s_doesnt_exist
push 0x550005
call fcn.004241a0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431090
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
or esi, 0xffffffff
cmp dword [0x5fdc84], 0
push edi
mov edi, dword [ebp + 8]
je 0x431147
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00420e40
add esp, 8
push 0xf01ff
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push eax
call fcn.0053b3a0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x431147
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431115
push edi
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.004241a0
add esp, 0xc
test eax, eax
jne 0x431118
mov esi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x43115a
push str.Failed_close_service_handle:__m
push 0x550003
call fcn.004241a0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.service__s_doesnt_exist
push 0x550005
call fcn.004241a0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4314d0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x24
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x43150e
push dword [ebp + 0x10]
push str.failed_query_service_status__s:__m
push 0x550003
call fcn.004241a0
add esp, 0xc
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4317b0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x1c]
lea esi, [ebp + 4]
add esi, 0xfffffffc
push esi
call fcn.00420e40
push dword [ebp + 0xc]
push esi
mov edi, dword [eax]
call fcn.00420e40
push dword [ebp + 8]
push esi
mov ebx, dword [eax]
call fcn.00420e40
add esp, 0x18
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [eax]
push dword [0x5fdc84]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
push eax
call fcn.0053b3a0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x431890
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
or edi, 0xffffffff
mov eax, dword [ebx]
test eax, eax
je 0x4318b0
push eax
call fcn.005414d0
add esp, 4
mov dword [ebx], 0
push 1
push 0x200
call fcn.005414c5
add esp, 8
mov dword [ebx], eax
lea ecx, [ebp + 0xc]
push ecx
push 0x200
push eax
push dword [ebp + 8]
call sub.PSAPI.DLL_EnumProcessModules
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431916
cmp dword [0x601c94], 6
jl 0x4318fb
push str.EnumProcessModules_failed:__m
push 0x550006
call fcn.004241a0
add esp, 8
mov eax, dword [ebx]
test eax, eax
je 0x431964
push eax
call fcn.005414d0
add esp, 4
mov dword [ebx], 0
mov eax, edi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
shr edi, 2
cmp edi, 0x80
jb 0x431964
push esi
lea esi, [edi*8]
push esi
push dword [ebx]
call fcn.00547937
add esp, 8
mov dword [ebx], eax
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push dword [ebp + 8]
call sub.PSAPI.DLL_EnumProcessModules
push eax
call fcn.0053b370
add esp, 4
pop esi
test eax, eax
je 0x43196a
mov ecx, dword [ebp + 0xc]
lea eax, [edi + edi]
shr ecx, 2
cmp ecx, eax
jae 0x431979
mov edi, ecx
mov eax, edi
pop edi
pop ebx
pop ebp
ret
push str.EnumProcessModules_2nd_failed:__m
push 0x550000
call fcn.00424700
push str.EnumProcessModules_no_space
push 0x550000
call fcn.00424700
int3

Function at 0x431a70
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431ab7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push eax
call fcn.0053b370
add esp, 4
test eax, eax
jne 0x431aec
push str.failed_CheckTokenMembership__:__m
push 0x550003
call fcn.004241a0
add esp, 8
mov dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret