joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803eb9e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 0x98]
cmp dword [esi], 0
jne 0x1803ebf9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x1803ebf5
jmp 0x1803ebef
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
cmp eax, ebx
jae 0x1803ebe6
or ecx, 0xffffffff
sub ecx, ebx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x1803ebf5
cmp dword [esi + 4], 0
jg 0x1803ebca
xchg dword [esi], edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1803f43a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 2
pop esi
mov ecx, dword [edi + 0x80]
cmp ecx, dword [edi + 0x84]
je 0x1803f46d
xor eax, eax
cmp dword [ecx + 0x14], eax
setne al
mov dword [ebp - 0xc], eax
mov esi, eax
mov al, byte [edi + 0x8d]
mov bl, byte [edi + 0x11]
mov dword [ebp - 0xc], eax
call fcn.1801f7c3
mov ecx, dword [edi + 0xc]
inc eax
push esi
push ebx
push dword [ebp - 0xc]
mov dl, byte [eax]
call fcn.18040bb2
add esp, 0xc
mov byte [edi + 0x8c], al
mov ecx, 0x181d7618
push eax
call fcn.1802639c
cmp byte [edi + 0x8c], 0
je 0x1803f4ba
call fcn.18016fdc
test al, al
je 0x1803f4ba
mov cl, 1
xor ebx, ebx
jmp 0x1803f4be
xor ebx, ebx
mov cl, bl
call fcn.1807645f
mov edx, dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18014d87
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
je 0x1803f59c
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1803f59c
movzx ecx, byte [0x181dc05a]
neg ecx
sbb ecx, ecx
and ecx, 0x181dbf50
je 0x1803f548
push 7
pop edx
push 3
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008b5d
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.1800724f
push dword [ebp - 0xc]
movzx eax, byte [edi + 0x8c]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d__Current_dir___s_
push eax
call fcn.18007230
mov ecx, dword [ebp - 0xc]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, edi
call fcn.1803fdf7
mov cl, byte [edi + 0x8c]
call fcn.18040a8a
push dword [edi + 0xc]
call fcn.1803fd13
test al, al
je 0x1803f57c
mov cl, byte [edi + 0x8c]
call fcn.180273d2
test al, al
je 0x1803f57c
mov edi, 0xa0430607
jmp 0x1803f5a3
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [edi + 0xc]
call fcn.1803fd65
mov edi, eax
mov ecx, edi
call fcn.1801ccbc
mov esi, dword [ebp - 8]
test edi, edi
js 0x1803f5a3
jmp 0x1803f5a5
call fcn.1801ba25
mov edi, eax
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret
Function at 0x180406b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call fcn.1801f7c3
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x180406e8
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.180074fa
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push 0x20019
push edi
mov dword [ebp - 0x18], 0x181a193c
mov dword [ebp - 0x10], 0x200
call fcn.1801a20e
mov ebx, eax
mov ecx, ebx
call fcn.1801ccbc
test ebx, ebx
js 0x1804085d
lea ecx, [ebp - 0x18]
call fcn.1801b1de
test eax, eax
je 0x18040858
push str.Clients
lea ecx, [ebp - 0x18]
call fcn.1801a270
test al, al
je 0x18040858
push str.ClientState
lea ecx, [ebp - 0x18]
call fcn.1801a270
test al, al
je 0x18040858
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18040858
push ebx
push ebx
push ebx
push ebx
push str.path
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18040858
mov dword [ebp - 8], ebx
call fcn.18006f9c
push eax
lea ecx, [ebp - 8]
call fcn.180076af
lea eax, [ebp - 8]
push eax
push str.version
lea ecx, [ebp - 0x18]
call fcn.1801a7f3
mov ebx, eax
mov ecx, ebx
call fcn.1801ccbc
test ebx, ebx
js 0x1804084b
and dword [ebp - 0x1c], 0
call fcn.1801f7c3
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x180407e4
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x1c]
call fcn.180074fa
and dword [ebp - 0xc], 0
call fcn.18006f9c
push eax
lea ecx, [ebp - 0xc]
call fcn.180076af
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
mov edx, 0x181ad908
mov ecx, esi
call fcn.1801c6c6
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.1801ccbc
test ebx, ebx
js 0x18040838
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18009c0f
test al, al
je 0x18040836
mov ebx, 0xa043090b
jmp 0x18040838
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea ecx, [esi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
jmp 0x1804085d
mov ebx, 0x80070003
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x181a193c
je 0x1804087e
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x200
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret
Function at 0x1804159a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815d980
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015c2c
test al, al
je 0x1804178b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.18136b80
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.180421c0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18041621
mov ecx, edi
call fcn.1801ccbc
test edi, edi
jns 0x1804178b
mov ecx, edi
call fcn.1801ccbc
test edi, edi
jns 0x18041633
mov eax, edi
jmp 0x1804178d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18041658
call fcn.1801ba25
mov esi, eax
jmp 0x18041787
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.180835bc
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1804168e
call fcn.1801ba25
mov esi, eax
jmp 0x18041772
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18043d16
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18041701
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x180416c0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b0950
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041755
call fcn.1801ba25
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18041760
push esi
call fcn.18122783
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1804178d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18121ed8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x180417a0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015c2c
test al, al
je 0x18041844
call fcn.1804229c
test al, al
jne 0x18041844
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180417e7
call fcn.1801ba25
mov ebx, eax
jmp 0x18041840
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180835bc
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1804181c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041827
call fcn.1801ba25
mov ebx, eax
test esi, esi
je 0x1804182e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18041846
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret
Function at 0x18041a6b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1815d980
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015c2c
test al, al
je 0x18041c5c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.18136b80
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18042629
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x18041af2
mov ecx, edi
call fcn.1801ccbc
test edi, edi
jns 0x18041c5c
mov ecx, edi
call fcn.1801ccbc
test edi, edi
jns 0x18041b04
mov eax, edi
jmp 0x18041c5e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18041b29
call fcn.1801ba25
mov esi, eax
jmp 0x18041c58
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.180834ff
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x18041b5f
call fcn.1801ba25
mov esi, eax
jmp 0x18041c43
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18043d16
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18041bd2
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18041b91
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181b0950
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041c26
call fcn.1801ba25
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18041c31
push esi
call fcn.18122783
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x18041c5e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18121ed8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18041c71
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015c2c
test al, al
je 0x18041d15
call fcn.18042705
test al, al
jne 0x18041d15
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18041cb8
call fcn.1801ba25
mov ebx, eax
jmp 0x18041d11
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180834ff
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18041ced
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18041cf8
call fcn.1801ba25
mov ebx, eax
test esi, esi
je 0x18041cff
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18041d17
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret

Function at 0x18042374
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18043034
test al, al
je 0x1804239c
xor eax, eax
jmp 0x1804244f
call fcn.180418eb
mov esi, eax
mov ecx, esi
call fcn.1801ccbc
test esi, esi
jns 0x180423b8
lfence
mov eax, esi
jmp 0x1804244f
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180423e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1804244d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1804244d
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180835bc
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1804241b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18042434
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042430
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x1804243b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret
Function at 0x180427dd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.180431e2
test al, al
je 0x18042805
xor eax, eax
jmp 0x180428b8
call fcn.18041dbc
mov esi, eax
mov ecx, esi
call fcn.1801ccbc
test esi, esi
jns 0x18042821
lfence
mov eax, esi
jmp 0x180428b8
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1804284d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x180428b6
movzx ebx, bx
or ebx, 0x80070000
jmp 0x180428b6
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180834ff
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18042884
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1804289d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042899
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x180428a4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret

Function at 0x180428c7
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1804290c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042981
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042981
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.180834ff
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18043156
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18042960
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18042967
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18042967
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f72
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret
Function at 0x180436f5
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push dword [ebp + 0xc]
push 0xff
push 0x100
push eax
call fcn.1800790f
push dword [eax + 4]
push dword [eax]
call fcn.1813e49b
xor eax, eax
add esp, 0x20
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [esi + 0x260], edi
jne 0x1804375b
push eax
call fcn.18146221
pop ecx
lea eax, [esi + 0x40]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1804378a
push edi
lea eax, [ebp - 0x208]
push eax
push edi
push 1
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18121ed8
leave
ret

Function at 0x18043a23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d7f60
push edi
mov edi, ecx
cmp dword [0x181d7f60], ebx
je 0x18043a64
push ecx
mov ecx, esi
call fcn.1803c486
mov ebx, eax
mov ecx, ebx
call fcn.1801ccbc
test ebx, ebx
js 0x18043ad2
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18043a46
lfence
cmp byte [edi + 0x3c], 0
je 0x18043ae0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18043ad9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18043c30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18043aa7
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18043ad9
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043ac9
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18043ae8
lfence
mov eax, ebx
jmp 0x18043af3
mov esi, 0x80004005
jmp 0x18043aec
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043af1
call fcn.180439df
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret 4
Function at 0x18043b48
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x181d8030
push edi
mov edi, ecx
cmp dword [0x181d8030], ebx
je 0x18043b89
push ecx
mov ecx, esi
call fcn.1803c486
mov ebx, eax
mov ecx, ebx
call fcn.1801ccbc
test ebx, ebx
js 0x18043bf7
add esi, 0x24
xor ebx, ebx
cmp dword [esi], ebx
jne 0x18043b6b
lfence
cmp byte [edi + 0x3c], 0
je 0x18043c05
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x18043bfe
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push edi
push 0x18043c30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x18043bcc
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18043bfe
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043bee
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18043c0d
lfence
mov eax, ebx
jmp 0x18043c18
mov esi, 0x80004005
jmp 0x18043c11
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
test esi, esi
jns 0x18043c16
call fcn.18043b04
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18121ed8
leave
ret 4

Function at 0x1804712b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esi + 0x1c]
call fcn.180487e9
mov edi, dword [esi + 0x18]
and dword [esi + 0x18], 0
test edi, edi
je 0x18047155
mov ecx, edi
call fcn.180874f4
push 0x24
push edi
call fcn.18122407
pop ecx
pop ecx
mov ecx, dword [0x181dbefc]
pop edi
pop esi
mov ecx, dword [ecx]
jmp fcn.1803eb9e