joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453370
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x47f1f0]
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x4726b0]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x4726b4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x453440
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
movzx esi, al
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
movzx ecx, al
shl ecx, 8
or esi, ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004530f0
movzx eax, al
shl eax, 0x10
or esi, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov al, 1
jmp 0x453442
xor al, al
mov ecx, dword [ebp - 4]
call fcn.0045d95d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45d70e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x473838
call fcn.0045dbf4
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x45d74e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45d74e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x45d766
cmp eax, 0x20b
je 0x45d753
mov dword [ebp - 0x1c], edi
jmp 0x45d77a
cmp dword [ecx + 0x84], 0xe
jbe 0x45d74e
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x45d774
cmp dword [ecx + 0x74], 0xe
jbe 0x45d74e
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x481364], 0xffffffff
or dword [0x481368], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x4812ec]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x4812e8]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x481360], eax
call fcn.0045dc4c
call fcn.0045dcec
cmp dword [0x47f218], edi
jne 0x45d7da
push fcn.0045dcec
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0045dcda
push 0x47f094
push 0x47f090
call sub.MSVCR71.dll__initterm
push 0x45dc90
call fcn.0045d9a4
mov eax, dword [0x4812e4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4812e0]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x45d82e
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x47f08c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x45d858
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x45d912
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x45d8c7
cmp ax, di
je 0x45d86e
cmp dword [ebp - 0x20], edi
jne 0x45d8c7
mov ax, word [esi]
cmp ax, di
je 0x45d883
cmp ax, 0x20
ja 0x45d883
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x45d86e
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x45d89f
movzx eax, word [ebp - 0x54]
jmp 0x45d8a2
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0045dfe4
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x45d8bf
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x45d90c
cmp ax, 0x22
jne 0x45d8d8
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x45d858
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0045dc2f
ret
Function at 0x7034c0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x735014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x64616f4d
cmp dword [0x759858], 0
je 0x7034fe
cmp dword [0x759854], 0
jne 0x7035da
xor ebx, ebx
mov edi, dword fs:[ebx + 0x30]
mov edi, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
push ebx
push ecx
mov ecx, 0x64616f4e
sub ecx, 3
mov ebx, ecx
pop ecx
add ebx, 1
cmp dword [esi], ebx
pop ebx
jne 0x703523
push ebx
pushal
or ch, ch
sbb ax, 0x2a
popal
mov ebx, 0x41797262
sub ebx, 2
add ebx, 1
cmp dword [esi + 8], ebx
pop ebx
jne 0x703523
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
sub ebp, 1
mov edi, dword [edi + ebp*4]
add edi, eax
pop ebp
mov dword [0x759858], edi
xor ebx, ebx
mov edi, dword fs:[ebx + 0x30]
mov edi, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
push eax
mov eax, 0x50746546
add eax, 1
cmp dword [esi], eax
pop eax
jne 0x70359a
push ebx
mov ebx, 0x73736571
add ebx, 1
cmp dword [esi + 0xa], ebx
pop ebx
jne 0x70359a
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
sub ebp, 1
mov edi, dword [edi + ebp*4]
add edi, eax
pop ebp
mov dword [0x759854], edi
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x759858]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x759854]
call eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0070aa05
mov esp, ebp
pop ebp
ret
Function at 0x703610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72557d
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x38
mov eax, dword [0x735014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x40], 0
jmp 0x703658
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x22400
jae 0x70372f
mov dword [ebp - 4], 0
cmp dword [ebp - 0x40], 0x22414
jae 0x7036e9
mov byte [ebp - 0x15], 5
xor ecx, ecx
mov byte [ebp - 0x15], cl
movzx edx, byte [ebp - 0x15]
cmp edx, 3
je 0x7036e9
mov eax, dword [ebp - 0x40]
mov cl, byte [eax + 0x735a70]
mov byte [ebp - 0x41], cl
movzx ecx, byte [ebp - 0x41]
mov eax, dword [ebp - 0x40]
xor edx, edx
div dword [ebp - 0x48]
movzx edx, byte [edx + 0x757e70]
xor ecx, edx
mov byte [ebp - 0x15], cl
mov eax, dword [ebp - 0x40]
mov cl, byte [eax + 0x735a70]
mov byte [ebp - 0x42], cl
movzx edx, byte [ebp - 0x15]
mov eax, dword [ebp - 0x40]
movzx ecx, byte [eax + 0x735a70]
add ecx, edx
mov edx, dword [ebp - 0x40]
mov byte [edx + 0x735a70], cl
movzx eax, byte [ebp - 0x42]
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ecx + 0x735a70]
sub edx, eax
mov eax, dword [ebp - 0x40]
mov byte [eax + 0x735a70], dl
jmp 0x70371a
mov dword [ebp - 4], 0xffffffff
jmp 0x70372a
jmp 0x70364f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0070aa05
mov esp, ebp
pop ebp
ret
Function at 0x703770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7255bd
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x735014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x4c], 0xa
mov dword [ebp - 0x58], 0x14
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, 0x758b78
call fcn.00703b70
push 0x10c
call fcn.00703750
add esp, 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], 0
jmp 0x7037ea
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x48]
jae 0x7038c2
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x48]
add ecx, 0x14
cmp dword [ebp - 0x40], ecx
jae 0x70387c
mov byte [ebp - 0x15], 5
xor edx, edx
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
cmp eax, 3
je 0x70387c
mov ecx, dword [ebp - 0x40]
mov dl, byte [ecx + 0x757e88]
mov byte [ebp - 0x41], dl
movzx ecx, byte [ebp - 0x41]
mov eax, dword [ebp - 0x40]
xor edx, edx
div dword [ebp - 0x54]
movzx edx, byte [edx + 0x757e70]
xor ecx, edx
mov byte [ebp - 0x15], cl
mov eax, dword [ebp - 0x40]
mov cl, byte [eax + 0x757e88]
mov byte [ebp - 0x42], cl
movzx edx, byte [ebp - 0x15]
mov eax, dword [ebp - 0x40]
movzx ecx, byte [eax + 0x757e88]
add ecx, edx
mov edx, dword [ebp - 0x40]
mov byte [edx + 0x757e88], cl
movzx eax, byte [ebp - 0x42]
mov ecx, dword [ebp - 0x40]
movzx edx, byte [ecx + 0x757e88]
sub edx, eax
mov eax, dword [ebp - 0x40]
mov byte [eax + 0x757e88], dl
jmp 0x7038ad
mov dword [ebp - 4], 0xffffffff
jmp 0x7038bd
jmp 0x7037e1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0070aa05
mov esp, ebp
pop ebp
ret

Function at 0x70b026
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x726054]
test eax, eax
je 0x70b065
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x70b065
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x70b065
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x70b065
cmp dword [ecx + 0x74], 0xe
jbe 0x70b065
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x719cb4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00719b2a

Function at 0x7258e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x72590d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x72590d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00478380
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x1010]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push 0x48b920
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012a9
push 0x1000
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], 3
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], 0x400
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x48b918
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4012a9
mov eax, dword [ebp - 0x100c]
push eax
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_operator]
push dword [ebp - 0x100c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x100c]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 0x2c
mov esi, 1
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041caaf
mov esp, ebp
pop ebp
ret

Function at 0x4012d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00478380
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x1010]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWARETencentQQGameSYS
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013b9
push 0x1000
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1008], 3
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], 0x400
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push str.GameDirectory
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4013b9
mov eax, dword [ebp - 0x100c]
push eax
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_operator]
push dword [ebp - 0x100c]
mov esi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x100c]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 0x2c
mov esi, 1
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
Function at 0x404e70
Capabilities:
Enumerate processes
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478d62
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], ecx
xor esi, esi
push esi
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x240]
push 0x228
push esi
push eax
mov dword [ebp - 0x254], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x18]
push 0x48bc70
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
lea eax, [ebp - 0x244]
mov dword [ebp - 4], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x405004
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x404fe9
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebp - 0x23c]
push 0x48bc7c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0xc
push dword [ebp - 0x14]
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x404fd8
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x404fd1
cmp dword [eax + 0x10], 0
je 0x404fca
mov ecx, dword [ebp - 0x248]
cmp dword [eax], ecx
jne 0x404fca
mov edx, dword [ebp - 0x24c]
lea esi, [eax + 0x60]
mov ecx, dword [ebp - 0x23c]
mov edi, edx
mov dword [ebp - 0x250], ecx
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
movups xmm0, xmmword [eax + 0x10]
mov ecx, dword [ebp - 0x248]
mov esi, dword [ebp - 0x250]
mov edi, dword [ebp - 0x254]
movups xmmword [edx + 0x3c], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [edx + 0x4c], xmm0
movq xmm0, qword [eax + 0x30]
movq qword [edx + 0x5c], xmm0
mov dword [edx + 4], ecx
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test esi, esi
jne 0x405004
call fcn.00403360
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404f03
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
Function at 0x4053d0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push 0x1c
push eax
push fcn.004053d0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
movzx eax, word [ebp + 0xc]
mov edi, dword [ebp - 0x1c]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x405463
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [ebp - 0x24]
mov edi, eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push 0x48b98c
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x405462
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
Function at 0x405d40
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
xor esi, esi
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x405dad
cmp dword [ebp + 8], ebx
je 0x405dc0
push 0xf01ff
push str.injectx64
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x405dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x405dc0
cmp eax, 0x424
je 0x405dc0
push esi
push esi
push str.OpenService
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x405dcc
jmp dword [eax*4 + 0x405e84]
push 0
push 0
push 0
push 0
push 0
push 0x496100
push 1
push 3
push 1
push 0xf01ff
push str.injectx64
push str.injectx64
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x405e55
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x431
sete bl
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x405e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x405e80
mov ebx, 1
test esi, esi
je 0x405e14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x405e1a
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x405e76
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x405e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp case.default.0x405dcc
Function at 0x405e60
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x494014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
xor esi, esi
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x405dad
cmp dword [ebp + 8], ebx
je 0x405dc0
push 0xf01ff
push str.injectx64
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x405dc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x405dc0
cmp eax, 0x424
je 0x405dc0
push esi
push esi
push str.OpenService
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x405dcc
jmp dword [eax*4 + 0x405e84]
push 0
push 0
push 0
push 0
push 0
push 0x496100
push 1
push 3
push 1
push 0xf01ff
push str.injectx64
push str.injectx64
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x405e55
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x431
sete bl
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041caaf
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x405e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x405e80
mov ebx, 1
test esi, esi
je 0x405e14
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x405e1a
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x405e76
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x405e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp case.default.0x405dcc