joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
push 0xa
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43f1f9
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43f1f9
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0043f200
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x43ffc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb5fc
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x250], 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4400f9
push str.Quarantine
lea ecx, [ebp - 0x228]
call fcn.004b3550
mov dword [ebp - 4], 0
push 0x5fce9c
lea ecx, [ebp - 0x234]
call fcn.004b3550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x240]
call fcn.004b3550
mov byte [ebp - 4], 2
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], edx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00412f50
add esp, 0xc
mov eax, dword [ebp - 0x250]
or eax, 1
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.004b3860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x240]
call fcn.004b3860
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.004b3860
mov eax, dword [ebp + 8]
jmp 0x44011a
mov ecx, dword [0x63e870]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b3550
mov edx, dword [ebp - 0x250]
or edx, 1
mov dword [ebp - 0x250], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 4
Function at 0x44a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9da8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6385e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x1d], 0
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x1c]
call fcn.004b3550
mov dword [ebp - 4], 0
push str.iaNvStor
lea ecx, [ebp - 0x1c]
call fcn.004b3b40
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea ecx, [ebp - 0x1c]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a1aa
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 4
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push str.Start
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a1a0
mov ecx, dword [ebp - 0x28]
push ecx
push str.iaNvStor_detected__d_r_n
call fcn.0054d5e0
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0
jb 0x44a1a0
cmp dword [ebp - 0x30], 2
jbe 0x44a19c
jmp 0x44a1a0
mov byte [ebp - 0x1d], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x1d]
mov byte [ebp - 0x29], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004b3860
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x44a1e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca348
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6385e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x1d], 0
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x1c]
call fcn.004b3550
mov dword [ebp - 4], 0
push str.iaNvStor
lea ecx, [ebp - 0x1c]
call fcn.004b3b40
lea eax, [ebp - 0x10]
push eax
push 3
push 0
lea ecx, [ebp - 0x1c]
call fcn.004553f0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a27c
mov dword [ebp - 0x24], 4
push 4
lea ecx, [ebp - 0x24]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44a272
mov byte [ebp - 0x1d], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x1d]
mov byte [ebp - 0x25], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004b3860
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x452ec0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edi, dword [ebp + 8]
add edi, 8
mov ecx, 8
mov esi, 0x5fa268
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
ret
Function at 0x478880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x2c], ecx
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4788c5
xor al, al
jmp 0x4789a6
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0054d3af
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004303b0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
jmp 0x478912
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jae 0x47897e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47897c
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x24], esp
mov edx, dword [ebp - 0x10]
push edx
call fcn.004b3550
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.00430300
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x478909
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
je 0x478992
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.004303b0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0054d555
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4789b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
mov ax, word [edx]
mov word [ebp - 0x12], ax
add dword [ebp - 0xc], 2
cmp word [ebp - 0x12], 0
jne 0x4789c8
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
shl edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x478ab0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6385e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x18]
call fcn.004b34a0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
jmp 0x478af9
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
call fcn.004b9730
cmp dword [ebp - 0x20], eax
jge 0x478b33
lea ecx, [ebp - 0x18]
call fcn.00404b70
test eax, eax
jle 0x478b1c
push 0
lea ecx, [ebp - 0x18]
call fcn.004b3a80
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00430700
push eax
lea ecx, [ebp - 0x18]
call fcn.004b3ad0
jmp 0x478af0
push 2
push 0x5fc600
lea ecx, [ebp - 0x18]
call fcn.004b3c00
lea ecx, [ebp - 0x18]
call fcn.00404b70
shl eax, 1
push eax
lea ecx, [ebp - 0x18]
call fcn.004553f0
push eax
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
xor edx, edx
cmp dword [ebp - 0x1c], 0
sete dl
mov byte [ebp - 0x21], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004b3860
mov al, byte [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x478c50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x478cca
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x478cc8
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x478be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x18], 0
je 0x478cbe
push 0x1388
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x478cbe
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x478d34
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x18], 0
je 0x478d34
call fcn.00422da0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x478d34
push str.Signaling_Unkillable_over_r_n
call fcn.0054d5e0
add esp, 4
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x22e084
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x2710
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.Unkillable_complete_r_n
call fcn.0054d5e0
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4
Function at 0x4796b0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb462
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x278], ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 6
jb 0x47989a
lea ecx, [ebp - 0x250]
call fcn.004b34a0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x604bd8
lea ecx, [ebp - 0x25c]
call fcn.004b3550
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x268]
call fcn.004b3550
mov byte [ebp - 4], 2
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x274]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x27c], eax
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x280]
push eax
lea ecx, [ebp - 0x250]
call fcn.004b3890
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.004b3860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x268]
call fcn.004b3860
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.004b3860
lea ecx, [ebp - 0x238]
call fcn.0047f460
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x250]
push edx
call fcn.00479cb0
add esp, 8
lea ecx, [ebp - 0x238]
call fcn.0047f5c0
push eax
lea ecx, [ebp - 0x244]
call fcn.0047f610
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x244]
call fcn.004b9730
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x284]
mov eax, dword [edx]
call eax
movzx ecx, al
test ecx, ecx
je 0x47986a
lea ecx, [ebp - 0x244]
call fcn.004b9730
mov dword [ebp - 0x288], eax
mov edx, dword [ebp - 0x288]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x288]
mov edx, dword [eax + 8]
call edx
push eax
mov ecx, dword [ebp - 0x278]
add ecx, 0x70
call fcn.0047f3c0
jmp 0x47980b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x244]
call fcn.0047f650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0047f4c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.004b3860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret
Function at 0x479cb0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1230
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x1014], eax
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.004b4e90
xor ecx, ecx
test eax, eax
setge cl
mov byte [ebp - 0x1009], cl
lea edx, [ebp - 0x1010]
push edx
push 0x1000
lea eax, [ebp - 0x1008]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x479d02
jmp 0x479e36
mov ecx, dword [ebp - 0x1010]
shr ecx, 2
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1224], 0
jmp 0x479d29
mov edx, dword [ebp - 0x1224]
add edx, 1
mov dword [ebp - 0x1224], edx
mov eax, dword [ebp - 0x1224]
cmp eax, dword [ebp - 4]
jae 0x479e36
mov ecx, dword [ebp - 0x1224]
mov edx, dword [ebp + ecx*4 - 0x1008]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], 0
je 0x479e31
lea eax, [ebp - 0x1010]
push eax
push 4
lea ecx, [ebp - 0x122c]
push ecx
mov edx, dword [ebp - 0x1228]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x479e24
xor eax, eax
mov word [ebp - 0x1220], ax
movzx ecx, byte [ebp - 0x1009]
test ecx, ecx
je 0x479dbf
push 0x104
lea edx, [ebp - 0x1220]
push edx
mov eax, dword [ebp - 0x122c]
push eax
mov ecx, dword [ebp - 0x1228]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
jmp 0x479dde
push 0x104
lea edx, [ebp - 0x1220]
push edx
mov eax, dword [ebp - 0x122c]
push eax
mov ecx, dword [ebp - 0x1228]
push ecx
call sub.PSAPI.DLL_GetModuleBaseNameW
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
lea edx, [ebp - 0x1220]
push edx
call fcn.0054e942
add esp, 8
test eax, eax
jne 0x479e24
mov eax, dword [ebp - 0x1224]
mov ecx, dword [ebp + eax*4 - 0x1008]
mov dword [ebp - 0x1230], ecx
lea edx, [ebp - 0x1230]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x1228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x479d1a
mov al, 1
mov ecx, dword [ebp - 0x1014]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret

Function at 0x479e50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [ebp - 5], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x479e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenThread___failed_with_error__d_r_n
call fcn.0054d5e0
add esp, 8
jmp 0x479eba
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x479eac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SuspendThread___failed_with_error__d_r_n
call fcn.0054d5e0
add esp, 8
jmp 0x479eb0
mov byte [ebp - 5], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x47bc50
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 2
je 0x47bd1c
push 0
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x47bc94
mov dword [ebp - 4], 1
jmp 0x47bd1c
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x47bcc8
mov eax, dword [ebp - 8]
and eax, 0xfffffffc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x47bd15
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CopyFileW___failed__error__d__r_nSource_s_r_nDestination_s_r_n
call fcn.0054eca8
add esp, 0x10
mov dword [ebp - 4], 3
jmp 0x47bd1c
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47d6c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47d6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___Failed_to_terminate_process__error:_d__r_n
call fcn.0054d5e0
add esp, 8
jmp 0x47d724
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x47d717
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___Failed_to_terminate_process__error:_d__r_n
call fcn.0054d5e0
add esp, 8
jmp 0x47d724
push str.___Success__r_n
call fcn.0054d5e0
add esp, 4
cmp dword [ebp - 4], 0
je 0x47d734
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x47d740
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47d88c
push 0xf01ff
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47d882
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
push str.Stopping:__s
call fcn.0054eca8
add esp, 8
lea ecx, [ebp - 0x28]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x47d802
mov dword [ebp - 0x2c], 0xa
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x47d802
cmp dword [ebp - 0x24], 3
jne 0x47d7f1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x605bc8
call fcn.0054d5e0
add esp, 4
jmp 0x47d7f3
jmp 0x47d802
mov edx, dword [ebp - 0x2c]
sub edx, 1
mov dword [ebp - 0x2c], edx
jne 0x47d800
jmp 0x47d802
jmp 0x47d7bf
cmp dword [ebp - 0x24], 1
jne 0x47d81b
push 0x605bcc
call fcn.0054eca8
add esp, 4
mov byte [ebp - 5], 1
jmp 0x47d828
push 0x605bd4
call fcn.0054eca8
add esp, 4
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x47d878
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
push str.Deleting:__s
call fcn.0054eca8
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x47d867
push 0x605bcc
call fcn.0054eca8
add esp, 4
mov byte [ebp - 5], 1
jmp 0x47d878
push 0x605bd4
call fcn.0054eca8
add esp, 4
mov byte [ebp - 5], 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8