joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fbd8
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x5220bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40fc04
xor eax, eax
jmp 0x40fd0c
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5a5bdc
push 0
push 0x5220f0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fc45
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40fd0c
push 0x522110
call fcn.0041e7b0
add esp, 4
push eax
push 0x52211c
push 1
push 0
push 0x522128
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40fc85
xor eax, eax
jmp 0x40fd0c
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5a5be0
push 0
push 0x522130
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fcc3
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40fd0c
push 0x522160
call fcn.0041e7b0
add esp, 4
push eax
push 0x52216c
push 1
push 0
push 0x522178
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40fd0a
xor eax, eax
jmp 0x40fd0c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4104fd
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x410517
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 3
cmp edx, dword [ebp + 8]
jbe 0x410535
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0xc]
mov dl, byte [ecx - 4]
mov byte [eax], dl
jmp 0x41050e
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax], 0x52
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x45
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 8]
mov byte [edx + 2], 0x4d
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax + 3], 0x20
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp + 8], ecx
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5221ec
push 0x5abd60
call fcn.0041e940
add esp, 8
push str.config.nt
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
call fcn.00408ac1
add esp, 4
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4105de
push 0x40003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41063d
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41061b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41063d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41063b
push 0x40005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x41063d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410a6b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.004109fb
cmp eax, 0xffffffff
jne 0x410a83
or eax, 0xffffffff
jmp 0x410cb8
mov eax, dword [0x5abf60]
push eax
call fcn.00407ddf
add esp, 4
cmp eax, 0xffffffff
jne 0x410aab
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410cb8
push 0x52233c
push 0x5ac400
call fcn.0041e930
add esp, 8
push 4
push 0x52234c
push 1
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410b04
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410cb8
mov dword [ebp - 0xc], 0xffff
push 0x522350
push 0x5ac400
call fcn.0041e930
add esp, 8
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410b63
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410cb8
mov dword [ebp - 0x10], 3
push 0x52235c
push 0x5ac400
call fcn.0041e930
add esp, 8
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410bc2
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410cb8
mov dword [ebp - 4], 1
push 0x522370
push 0x5ac400
call fcn.0041e930
add esp, 8
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410c21
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410cb8
mov ecx, dword [0x5abf60]
push ecx
call fcn.0040787b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x410c4b
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410cb8
cmp dword [0x42dfc0], 0
je 0x410c74
push 0xd
push 0x522388
push 1
push 0x522398
push 0x5223a4
call fcn.00408266
add esp, 0x14
mov dword [ebp - 8], eax
jmp 0x410c92
push 9
push 0x5223d8
push 1
push 0x5223e4
push 0x5223f0
call fcn.00408266
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x410ca9
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410cb8
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410cbc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5abf60
push 0x5abb40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410cf0
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410d63
push 0x522424
push 0x5ac400
call fcn.0041e930
add esp, 8
push 0xd
push str.Devicehasp
push 1
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410d39
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410d63
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x410d61
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410d63
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x410e1c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
push 0x5abb40
call fcn.0041e930
add esp, 8
push str.Parallel_arbitrator
push 0x5ac3c0
call fcn.0041e930
add esp, 8
push 0x5abf60
push 0x5abb40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410e79
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410f07
push str.HASP
push 0x5ac400
call fcn.0041e930
add esp, 8
push 0
push 0
push 0x5ac640
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410edd
push 0x5ac400
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410edd
push 0x10004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410f07
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410f05
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x410f07
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x410f0b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov ecx, 7
mov esi, str._SystemRoot_System32Drivers_
lea edi, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x78
xor eax, eax
lea edi, [ebp - 0x1e9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x522518
lea eax, [ebp - 0x208]
push eax
call fcn.0041e940
add esp, 8
push 0x522520
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x410fb8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.0041e930
add esp, 8
push 0x522528
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041e940
add esp, 8
push 0x52252c
lea edx, [ebp - 0x208]
push edx
call fcn.0041e940
add esp, 8
push 0x522534
lea eax, [ebp - 0x208]
push eax
call fcn.0041e940
add esp, 8
push str.SYSTEMCurrentControlSetServicesEventLogSystem_
push 0x5ac1a0
call fcn.0041e930
add esp, 8
push 0x522570
push 0x5ac1a0
call fcn.0041e940
add esp, 8
push 0x5abf60
push 0x5ac1a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41100f
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4110e3
push str.EventMessageFile
push 0x5ac400
call fcn.0041e930
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041e7b0
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x208]
push edx
push 2
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411078
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4110e3
push str.TypesSupported
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 8], 7
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4110d4
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4110e3
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4110e9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x210]
push eax
push 0x10008
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4111b6
mov dword [ebp - 0x10c], 0
cmp dword [ebp - 8], 0
jne 0x4111b4
mov dword [ebp - 4], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x103
jne 0x411186
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4111b4
cmp dword [ebp - 8], 0
jne 0x4111af
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x411125
jmp 0x4111d2
cmp dword [ebp - 8], 2
jne 0x4111c0
xor eax, eax
jmp 0x4111d4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4111d4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4111d8
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41126b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x431
jne 0x41123a
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4112bf
cmp dword [ebp - 8], 0x430
je 0x411255
push 0x20003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4112bf
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x411272
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x430
jne 0x411285
cmp dword [ebp - 0xc], 0xa
jl 0x4111e5
cmp dword [ebp - 0xc], 0xa
jne 0x41129d
push 0x20003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4112bf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4112bd
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4112bf
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4112c3
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4112fa
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4113f5
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4113d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x420
jne 0x4113b7
lea eax, [ebp - 0x3c]
push eax
push 1
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411363
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4113f5
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x411363
push 0
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4113b5
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4113f5
jmp 0x4113d3
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4113f5
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4113f3
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4113f5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4113f9
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x411444
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x41142f
xor eax, eax
jmp 0x4114d5
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4114d5
lea edx, [ebp - 0x3c]
push edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x411494
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x41c
je 0x411494
cmp dword [ebp - 0x40], 0x426
je 0x411494
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4114d5
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x411494
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x4114d3
push 0x20004
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4114d5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4114d9
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41151c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x41150a
xor eax, eax
jmp 0x411568
push 0x20005
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411568
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x411546
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x20008
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411568
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x411566
push 0x20002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411568
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41165a
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x654], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x5ac180], eax
cmp dword [0x5ac180], 0
jne 0x4116b6
push 0x20001
call fcn.00406ccc
add esp, 4
push 0x2008001
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x41186d
cmp dword [ebp + 0xc], 0
je 0x4116e1
mov eax, dword [ebp + 0xc]
push eax
push 0x5abd60
call fcn.0041e930
add esp, 8
push 0x52259c
push 0x5abd60
call fcn.0041e940
add esp, 8
jmp 0x411703
push 0x200
push 0x5abd60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5225a0
push 0x5abd60
call fcn.0041e940
add esp, 8
push 0x5abd60
lea ecx, [ebp - 0x64c]
push ecx
call fcn.0041e930
add esp, 8
push 0x5225ac
lea edx, [ebp - 0x64c]
push edx
call fcn.0041e940
add esp, 8
push 0x5abd60
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x5225bc
lea ecx, [ebp - 0x200]
push ecx
call fcn.0041e940
add esp, 8
push 0x5225c4
lea edx, [ebp - 0x200]
push edx
call fcn.0041e940
add esp, 8
mov eax, dword [ebp + 8]
and eax, 2
test eax, eax
je 0x411792
lea ecx, [ebp - 0x200]
push ecx
push 0x5225cc
mov edx, dword [0x5ac180]
push edx
call fcn.004111d8
add esp, 0xc
mov dword [ebp - 0x650], eax
mov eax, dword [ebp + 8]
and eax, 1
test eax, eax
je 0x4117c6
cmp dword [ebp - 0x650], 0
jne 0x4117c6
lea ecx, [ebp - 0x64c]
push ecx
push 0x5225d4
mov edx, dword [0x5ac180]
push edx
call fcn.004111d8
add esp, 0xc
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x650], 0xffffffff
je 0x4117d8
cmp dword [ebp - 0x654], 0xffffffff
jne 0x4117f6
mov eax, dword [0x5ac180]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2008006
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x41186d
mov ecx, dword [0x5ac180]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
jne 0x411831
push 0x20002
call fcn.00406ccc
add esp, 4
push 0x2008001
call fcn.00406c68
add esp, 4
or eax, 0xffffffff
jmp 0x41186d
push 0x5225e0
lea edx, [ebp - 0x44c]
push edx
call fcn.0041e930
add esp, 8
push 0x52260c
lea eax, [ebp - 0x44c]
push eax
call fcn.0041e940
add esp, 8
lea ecx, [ebp - 0x44c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x411a2a
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 4]
push eax
push 0x52263c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411a97
cmp dword [ebp - 8], 5
jne 0x411a75
push 0x2010000
call fcn.00406c68
add esp, 4
push 0
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411b6a
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411b6a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesHaspCheck
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x200
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Aladdin_TestX.ttt
lea eax, [ebp - 0x208]
push eax
call fcn.0041e940
add esp, 8
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x411b4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jne 0x411b2d
push 0x2010000
call fcn.00406c68
add esp, 4
push 0
call fcn.00406ccc
add esp, 4
jmp 0x411b47
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10007
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x411b6a
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x208]
push eax
call fcn.00408ac1
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412073
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x522738
push 0x5ac1a0
call fcn.0041e930
add esp, 8
push str.PcmciaDataBaseAladdin_Knowledge_Systems_Ltd.PC_CardHASP_V1.1
push 0x5ac1a0
call fcn.0041e940
add esp, 8
push 0x5abf60
push 0x5ac1a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4120bd
xor eax, eax
jmp 0x412122
push 0x52279c
push 0x5ac400
call fcn.0041e930
add esp, 8
push 7
push 0x5227a4
push 1
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412113
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x412122
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret