joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ed90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x9c
call fcn.005cf450
mov eax, dword [0x659bc0]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb0]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, dword [esp + 0xac]
push edi
mov edi, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], 0
test edi, edi
je 0x53edfd
cmp edi, eax
je 0x53edf1
test ebp, ebp
je 0x53ee70
test ebx, ebx
js 0x53ee70
mov dword [esp + 0x10], 1
mov dword [esi], edi
jmp 0x53ee03
test eax, eax
je 0x53ee70
mov edi, eax
push edi
call fcn.004b4780
add esp, 4
test al, 2
jne 0x53ee70
test ebp, ebp
je 0x53ef7b
push edi
mov dword [esp + 0x14], 1
call fcn.004d3940
add esp, 4
cmp eax, 0x90
jg 0x53ee70
cmp eax, ebx
jge 0x53ee8b
push dword [esp + 0x14]
push edi
push dword [esi + 4]
call fcn.004da240
add esp, 0xc
test eax, eax
je 0x53ee70
push ebx
push ebp
push dword [esi + 4]
call fcn.004da3f0
add esp, 0xc
test eax, eax
je 0x53ee70
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.004da1a0
add esp, 0xc
test eax, eax
jne 0x53eea7
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005ce5ea
add esp, 0x9c
ret
cmp ebx, 0x90
ja 0x53ee70
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x90
je 0x53eeca
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x53eed0
mov ebp, dword [esp + 0x14]
push ebp
push edi
push dword [esi + 8]
call fcn.004da240
add esp, 0xc
test eax, eax
je 0x53ef88
push edi
call fcn.004d3940
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.004da3f0
add esp, 0x10
test eax, eax
je 0x53ef88
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x90
jl 0x53ef20
push ebp
push edi
push dword [esi + 0xc]
call fcn.004da240
add esp, 0xc
test eax, eax
je 0x53ef88
push edi
call fcn.004d3940
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.004da3f0
add esp, 0x10
test eax, eax
je 0x53ef88
push dword [esi + 8]
push dword [esi + 4]
call fcn.004da580
xor ebp, ebp
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebp, ecx
jmp 0x53ef8a
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x53ef5f
jmp 0x53eece
xor ebp, ebp
test ebx, ebx
je 0x53efa0
lea eax, [esp + 0x18]
push 0x90
push eax
call fcn.00401320
add esp, 8
mov eax, ebp
jmp 0x53ee72
Function at 0x57b560
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x57b574
mov dword [esp + 0x18], fcn.00579d30
jmp fcn.00573290
mov dword [esp + 0x18], fcn.00578fd0
jmp fcn.00572f90
Function at 0x5c0080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.005cf450
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x5c010a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x5c010e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.004d7d00
push eax
call fcn.004d3950
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x5c0117
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x5c00c2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x5c0193
mov edx, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr edx, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, esi
lea edi, [edi - 1]
sub eax, ebp
mov ecx, ebp
shr ecx, 0x1f
inc ebp
shr eax, 0x1f
xor al, cl
xor cl, dl
or al, cl
movzx ecx, byte [esp + 0x2c]
dec al
movzx edx, al
movzx eax, byte [edi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x10]
jb 0x5c0155
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [esp + 0x2c], ecx
not ecx
pop ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret
Function at 0x5ce500
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x5ce527
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x5ce52a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.005ce4dc
pop esi
leave
ret 8

Function at 0x5cf713
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5cf752
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5cf752
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5cf752
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x5cf752
cmp dword [ecx + 0x74], 0xe
jbe 0x5cf752
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40aae0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
sub esp, 0x82c
cmp dword [0x484004], 0x13f7
mov eax, dword [esp + 0x830]
push ebx
mov ebx, dword [eax + 4]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x844]
mov eax, dword [edi]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
jne 0x40ab32
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
cmp dword [0x484004], 0x60b
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
jne 0x40ab80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov dword [esp + 0x1c], 0x20
mov ecx, dword [esp + 0x24]
mov eax, esi
push ecx
shl eax, 4
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
call fcn.0040aa90
lea eax, [esi + ebp]
mov dword [esp + 0x14], eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x484004], 0x1b
mov dword [esp + 0x10], eax
mov dword [0x467464], 0xffcf03fc
jne 0x40abf1
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0x401390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x14]
mov dword [0x467464], 0
xor eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [0x467464], eax
sub ebx, dword [esp + 0x10]
mov edi, ebx
shl edi, 4
cmp dword [0x484004], 0x78c
mov dword [esp + 0x18], ebx
jne 0x40ac3c
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, ebx
shr ecx, 5
mov dword [0x467468], 0xc5e121b4
mov dword [0x46746c], 0xffffffff
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x34]
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x28]
lea eax, [edi + edx]
xor eax, dword [esp + 0x10]
add ebp, 0x61c88647
xor eax, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
sub esi, eax
sub dword [esp + 0x1c], 1
jne 0x40ab88
mov eax, dword [esp + 0x840]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov dword [eax + 4], ebx
pop ebx
add esp, 0x82c
ret 8
Function at 0x40acb0
Capabilities:
Copy file
Manipulate console buffer
Terminate thread

Disassembly:
sub esp, 0xaa8
push esi
xor esi, esi
cmp dword [0x484004], 0x516
jne 0x40ad05
push esi
lea eax, [esp + 0x2b0]
push eax
push esi
call sub.KERNEL32.dll_VerLanguageNameA
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor ecx, ecx
xor edx, edx
mov word [esp + 6], dx
lea eax, [esp + 8]
push eax
mov word [esp + 8], cx
mov ecx, dword [esp + 8]
push ecx
push esi
lea edx, [esp + 0x6b8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [esp + 0xab4]
shr eax, 3
cmp eax, esi
jbe 0x40ae49
mov ecx, dword [esp + 0xab0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileExW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x40ad40
cmp dword [0x484004], 0x29
jne 0x40ad80
xor eax, eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov dword [esp + 0x30], esi
call edi
push esi
push esi
push esi
push esi
push esi
push esi
call ebx
lea ecx, [esp + 0x3c]
push ecx
push 0x4013a0
call ebp
cmp dword [0x484004], 0xe1b
jne 0x40ada2
lea edx, [esp + 0x2b8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x484004], 0x1c
jne 0x40adf7
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push esi
push esi
push esi
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea edx, [esp + 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp + 0xac4]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.0040aae0
cmp dword [0x484004], 0x4fa
jne 0x40ae36
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x38]
push edx
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], cx
mov eax, dword [esp + 0x1c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x40ad40
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xaa8
ret 0xc
Function at 0x40ae60
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Get disk information
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub esp, 0x38
cmp dword [0x484004], 0x37
jne 0x40af37
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x4013b0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0x401464
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x401474
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0x40148c
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [esp], 0
mov eax, dword [0x484008]
add dword [esp], eax
mov eax, 0x38d6
add dword [esp], eax
mov ecx, dword [esp]
mov eax, dword [esp + 0x3c]
mov dl, byte [ecx + eax]
mov ecx, dword [0x467460]
mov byte [ecx + eax], dl
add esp, 0x38
ret 4

Function at 0x40afa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x45cda8
mov byte [0x45cda9], al
mov byte [0x45cdaa], 0x72
mov byte [0x45cdb0], 0x2e
mov byte [0x45cdb1], 0x64
mov byte [0x45cdb2], cl
mov byte [0x45cdb4], 0
mov byte [0x45cdac], al
mov byte [0x45cdad], cl
mov byte [0x45cdae], 0x33
mov byte [0x45cdaf], 0x32
mov byte [0x45cdb3], al
mov byte [0x45cdab], 0x6e
mov byte [0x45cda8], 0x6b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x484004]
mov edx, dword [0x467460]
mov dword [0x48369c], eax
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
mov byte [0x45cdb6], 0
mov byte [0x45cdaf], 0x50
mov byte [0x45cdad], 0x61
mov byte [0x45cda8], 0x60
mov byte [0x45cdb0], 0x7c
mov byte [0x45cdb1], 0x6f
mov byte [0x45cdb5], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x40c740
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c75f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40c766
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40c77d
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412290
add esp, 4
or eax, 0xffffffff
jmp 0x40c77f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41a420
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b8a4]
jne 0x41a42a
repz ret
jmp fcn.00422aa0
Function at 0x405470
Capabilities:
Delete service
Enumerate services
Query service status
Resolve function by parsing pe exports
Start service
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.00405490
cmp byte [0x40ebc4], 0
jne 0x406720
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00405490
Function at 0x4061c4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40cc80
call fcn.00406504
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x406224
cmp eax, 0xffffffff
je 0x406224
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40621d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40621d
cmp edx, 0x10000000
jae 0x40621d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40621a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00406549
ret 4

Function at 0x406270
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4062ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4062a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4062b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x406296
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x406380
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x406396
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4063b1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x4089be
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
push edx
push ecx
xor esi, esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
jne 0x4089f1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
jmp 0x408a36
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x408a22
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x408a22
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x408a34
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x408d91
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
push edx
push ecx
xor esi, esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
jne 0x408dc6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
mov esi, eax
jmp 0x408e09
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push ecx
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x408df7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x408df7
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x408e09
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x408e12
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
push edx
push ecx
xor esi, esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
jne 0x408e47
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
mov esi, eax
jmp 0x408e8a
mov al, byte [ebp + 8]
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
push 0xb
push ecx
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x408e78
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x408e78
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x408e8a
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x408e93
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
push edx
xor esi, esi
push ecx
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
jne 0x408ecb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
mov esi, eax
jmp 0x408f20
mov ax, word [ebp + 8]
mov edx, 0xffff
cmp ax, dx
jne 0x408edf
mov byte [ebp - 2], 1
jmp 0x408ee3
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 9
push ecx
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x408f0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x408f0e
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x408f20
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x408f29
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 2
push edx
xor esi, esi
push ecx
mov edi, esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x408f62
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
mov esi, eax
jmp 0x409019
mov ecx, dword [ebp + 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x408f68
sub ecx, edx
sar ecx, 1
push ebx
lea ebx, [ecx*2 + 4]
push ebx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x408fa4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x404dec
call fcn.0040889b
mov esi, eax
jmp 0x409018
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.0040c6c3
movzx eax, word [edi]
mov ecx, edi
test ax, ax
je 0x408fd4
mov edx, eax
cmp dx, 0x2f
jne 0x408fc7
xor eax, eax
mov word [ecx], ax
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x408fbc
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
mov eax, dword [ebp + 0xc]
push 6
push dword [eax]
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x409006
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x409006
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x409018
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
pop ebx
push edi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x40902a
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 2
push edx
push ecx
xor esi, esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
jne 0x40905f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x401478
call fcn.0040889b
mov esi, eax
jmp 0x4090a2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 5
push ecx
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x409090
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x409090
mov edx, esi
mov ecx, 0x40448c
call fcn.0040889b
jmp 0x4090a2
push 0x64
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x40448c
pop ecx
call fcn.0040a4ce
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40b907
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov dword [ebp - 4], edx
mov edi, ecx
call fcn.0040a212
test eax, eax
je 0x40b934
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push dword [0x40ebc0]
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_WriteConsoleW]
jmp 0x40b983
mov eax, dword [ebp - 4]
push ebx
push esi
add eax, eax
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40b981
mov edx, dword [ebp - 4]
push ebx
push ebx
lea ecx, [edx + edx]
push ecx
push esi
push edx
push edi
push ebx
push 1
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b97a
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [0x40ebc0]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret