joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4294c0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x42969c
test esi, esi
je 0x42969c
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x42969c
push ebx
mov ebx, dword [esp + 0x20]
mov eax, ebx
call fcn.00429430
cmp dword [ebp], eax
jge 0x429501
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
xor eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ecx
mov ebp, 0x13
mov dword [esp + 0x14], eax
test ebx, ebx
jl 0x42960e
cmp eax, ebx
jne 0x429563
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
mov ebp, eax
sar ebp, 2
test ebp, ebp
jle 0x4295d8
mov eax, ebp
lea esp, [esp]
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi], dl
shl ecx, 6
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
shl ecx, 6
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub eax, 1
jne 0x429570
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + ebp*4]
add eax, 2
mov byte [esi], 0xd
inc esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
inc eax
mov byte [esi], 0xa
inc esi
cmp eax, ebx
mov dword [esp + 0x14], eax
jle 0x429548
cmp dword [esp + 0x10], 0
je 0x42960e
sub esi, 2
sub dword [esp + 0x10], 2
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0x20]
sub ecx, eax
je 0x429685
lea ebp, [ecx + 1]
test ebp, ebp
je 0x429685
xor eax, eax
test ecx, ecx
jle 0x42962a
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x429638
movzx edx, byte [edi]
or eax, edx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x429645
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test ebp, ebp
jle 0x429666
mov ecx, ebp
mov edi, edi
mov edx, eax
shr edx, 0x1a
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789ABCDEF_]
mov byte [esi], dl
inc esi
shl eax, 6
sub ecx, 1
jne 0x429650
add dword [esp + 0x10], ebp
mov edi, 4
sub edi, ebp
test edi, edi
jle 0x429681
push edi
push 0x3d
push esi
call fcn.005985f0
add esp, 0xc
add dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
pop esi
mov dword [eax], ecx
mov eax, 1
pop ebp
add esp, 0xc
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x429dc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5d365a
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x808], eax
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x82c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
mov esi, 1
mov dword [esp + 0x824], esi
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esp + 0x830]
cmp dword [eax - 4], esi
jle 0x429e4d
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x834]
push edx
call fcn.0040db00
mov eax, dword [esp + 0x830]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429e50
lea edi, [esp + 0x18]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x429e64
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
lea ecx, [esp + 0x1c]
call fcn.0040b8a0
mov dword [esp + 0x10], 1
mov byte [esp + 0x824], 0
lea ecx, [esp + 0x830]
call fcn.0040b950
mov eax, ebp
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0059393a
add esp, 0x818
ret
Function at 0x42a180
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5d6921
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x834]
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [esp + 0x1c], 0
lea esi, [esp + 0x1c]
je 0x42a26c
mov edx, dword [0x6e9718]
mov eax, dword [edx + 0xc]
mov ecx, 0x6e9718
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x82c], 1
push esi
push 0x699654
lea edi, [esp + 0x20]
call fcn.00421d60
mov ebx, edi
add esp, 8
mov edi, ebp
call fcn.0041ce00
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a224
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dword [esp + 0x82c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42a262
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esi], 0
jne 0x42a1e2
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0059393a
add esp, 0x81c
ret
Function at 0x42a2a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d68d1
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x828]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 0x10]
mov dword [esp + 0x18], esi
cmp dword [esi + 0xc], ebx
jbe 0x42a2f3
call fcn.0059471a
mov edi, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [esp + 0x10], eax
cmp edi, dword [esi + 0x10]
jbe 0x42a306
call fcn.0059471a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebx
push ecx
push edi
push eax
push esi
lea ebx, [esp + 0x24]
call fcn.0043a150
lea edx, [esp + 0x1c]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [esp + 0x1c], 0
lea esi, [esp + 0x1c]
je 0x42a3f5
lea ebx, [ebx]
mov eax, dword [0x6e9718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6e9718
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ebx, 1
mov dword [esp + 0x830], ebx
push esi
push 0x699654
lea edi, [esp + 0x18]
call fcn.00421d60
mov edi, dword [esp + 0x18]
add esp, 8
cmp dword [edi - 4], ebx
jle 0x42a38f
mov eax, dword [edi - 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0040db00
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x42a3ac
mov edi, dword [esp + 0x18]
lea ebx, [esp + 0x10]
call fcn.0041ce00
mov edi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42a3b1
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dword [esp + 0x830], 0xffffffff
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42a3eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp word [esi], 0
jne 0x42a340
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0059393a
mov esp, ebp
pop ebp
ret
Function at 0x42a930
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x5cfd34
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28c]
mov dword [esp + 0x280], 0
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, 0x698f40
call fcn.004176f0
add esp, 8
mov byte [esp + 0x280], 1
mov eax, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
mov byte [esp + 0x280], 0
lea ecx, [esp + 0x1c]
call fcn.0040b950
cmp ebp, 0xffffffff
je 0x42aaf9
mov ecx, 0x6996a4
lea eax, [esp + 0x50]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a9f8
test dx, dx
je 0x42a9f4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a9f8
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a9d2
xor eax, eax
jmp 0x42a9fd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42aade
mov ecx, 0x6996a8
lea eax, [esp + 0x50]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42aa36
test dx, dx
je 0x42aa32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42aa36
add eax, 4
add ecx, 4
test dx, dx
jne 0x42aa10
xor eax, eax
jmp 0x42aa3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42aade
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x692fe8
call fcn.004176f0
mov byte [esp + 0x288], 2
push eax
lea edx, [esp + 0x20]
push edx
lea ebx, [esp + 0x60]
call fcn.004176f0
add esp, 0x10
mov bl, 4
mov byte [esp + 0x280], bl
lea ecx, [esp + 0x18]
call fcn.0040b950
lea edi, [esp + 0x14]
call fcn.0040bc80
test byte [esp + 0x24], 0x10
je 0x42aac0
push esi
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
mov ecx, edi
push ecx
push eax
call fcn.0040b840
mov byte [esp + 0x288], 5
mov byte [esp + 0x288], bl
call fcn.0042a930
add esp, 8
jmp 0x42aacd
mov eax, dword [esp + 0x44]
add dword [esi], eax
mov ecx, dword [esp + 0x40]
adc dword [esi + 4], ecx
mov byte [esp + 0x280], 0
lea ecx, [esp + 0x14]
call fcn.0040b950
lea edx, [esp + 0x24]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42a9c9
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x288]
call fcn.0040b950
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0059393a
add esp, 0x270
ret
Function at 0x42ab40
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5cfcd9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x2c]
push esi
call fcn.0040b610
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x30]
push ebx
push ebx
push 3
push ebx
push ebx
push closesocket
push eax
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42ac20
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.0059409d
mov edx, dword [esp + 0x18]
add esp, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push edx
mov esi, eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov byte [esi + eax], bl
cmp esi, ebx
jne 0x42abde
xor eax, eax
jmp 0x42abec
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42abe3
sub eax, edx
mov ebx, dword [esp + 0x2c]
mov edi, eax
push esi
mov eax, ebx
call fcn.0040f500
push esi
call fcn.00593fc0
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x42ac40
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c8c10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], 1
xor bl, bl
mov dword [esp + 0xc], 0
mov dword [esp + 0x20], eax
cmp eax, 0x80000001
jne 0x42aca6
lea eax, [esp + 0x20]
push eax
push 0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42ad3b
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 2
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42acf3
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x30]
push ecx
push 4
push edx
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0xc]
push ecx
call esi
test bl, bl
je 0x42ad0a
mov edx, dword [esp + 0x20]
push edx
call esi
mov eax, dword [0x6eac4c]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x24]
call fcn.0040b950
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.0040b950
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esp + 0x20], closesocket
jmp 0x42aca6
Function at 0x42b0b0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x42b147
lea eax, [esp + 0xc]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42b144
lea ecx, [esp + 0x10]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x42b13d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ebx
push ebx
push 0x10
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
push ebx
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42b13d
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
call edi
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x20
ret

Function at 0x42b2e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, closesocket
mov dword [esp + 4], 0
test ecx, ecx
je 0x42b31a
push 0
lea eax, [esp + 8]
push eax
push 0
push 2
push 0
push 0
push 0
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42b370
mov eax, dword [esp + 4]
test edi, edi
je 0x42b345
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push edi
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x42b363
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret
Function at 0x42b3c0
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6aa4f8
push 0x598460
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x7530
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push 1
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call ebx
test eax, eax
jne 0x42b5b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x42b492
mov eax, dword [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x42b492
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
push eax
push esi
push 1
push edi
call ebx
test eax, eax
jne 0x42b4a6
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x6d26f8
call fcn.005a9d14
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [ebp - 0x28], ebx
jmp 0x42b4b0
cmp ebx, dword [ebp - 0x24]
jae 0x42b5ad
lea edx, [ebx + ebx*8]
lea esi, [esi + edx*4]
mov ecx, 9
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
push 0x24
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
jne 0x42b50f
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x6d26f8
call fcn.005a9d14
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov dword [ebp - 4], edi
lea eax, [ebp - 0x70]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x42b47f
jmp 0x42b530
cmp dword [ebp - 0x6c], edi
je 0x42b581
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push 0x24
lea ecx, [ebp - 0x70]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42b4e8
cmp dword [ebp - 0x6c], edi
je 0x42b581
call fcn.0042baa0
xor ecx, ecx
sub eax, dword [ebp - 0x30]
sbb edx, ecx
cmp edx, ecx
jb 0x42b57a
ja 0x42b4e8
cmp eax, dword [ebp - 0x34]
ja 0x42b4e8
mov edi, 1
jmp 0x42b530
mov dword [ebp - 4], 0
call fcn.0042b5a5
add ebx, edi
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp - 0x2c]
jmp 0x42b4b0
mov dword [ebp - 4], 0xfffffffe
call fcn.0042b5d3
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b5f0
Capabilities:
Modify service

Disassembly:
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x42b624
push 0xf003f
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42b62a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x42b65b
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
ret
push ebx
call fcn.0042b680
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x42b680
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x48
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebp
push esi
push edi
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x1c], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x42b6e2
mov eax, dword [esp + 0x5c]
push 0x2c
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42b6ec
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x3c]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42b81c
mov eax, dword [esp + 0x38]
cmp eax, 1
jne 0x42b71a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
mov edi, dword [esp + 0x1c]
cmp eax, 3
jne 0x42b793
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x3c]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42b818
cmp dword [esp + 0x38], 1
je 0x42b818
lea eax, [esp + 0x24]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor edx, edx
sub eax, edi
sbb ecx, edx
test ecx, ecx
ja 0x42b818
jb 0x42b78c
cmp eax, 0x7530
ja 0x42b818
cmp dword [esp + 0x38], 3
je 0x42b723
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.0042b3c0
add esp, 4
lea ecx, [esp + 0x34]
push ecx
mov ebp, 1
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x42b818
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
cmp dword [esp + 0x38], ebp
je 0x42b814
jmp 0x42b7d0
lea edx, [esp + 0x14]
push edx
push 0x24
lea eax, [esp + 0x3c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42b818
cmp dword [esp + 0x38], ebp
je 0x42b814
mov ecx, dword [esp + 0x4c]
push ecx
call ebx
call fcn.0042baa0
xor ecx, ecx
sub eax, edi
sbb edx, ecx
test edx, edx
ja 0x42b818
jb 0x42b80e
cmp eax, 0x7530
ja 0x42b818
cmp dword [esp + 0x38], ebp
jne 0x42b7d0
mov dword [esp + 0x18], ebp
mov edi, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x42bcf0
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x5d3522
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0xc], 0
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x104
mov word [esp + 0x1c], ax
call fcn.005985f0
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push esi
lea ecx, [esp + 0x14]
call fcn.0040b8a0
mov dword [esp + 0x224], 0
mov dword [esp + 4], 1
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0059393a
add esp, 0x224
ret