joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401700
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x218], eax
mov ebx, edx
mov eax, dword [ebp + 0x18]
mov edi, ecx
push 0x463644
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x30
call fcn.0043198f
mov esi, eax
add esp, 4
test esi, esi
je 0x401756
push 0x30
push 0
push esi
call fcn.0043cf50
add esp, 0xc
jmp 0x401758
xor esi, esi
mov eax, dword [ebp + 0x14]
push dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
mov dword [esi], eax
call fcn.00414630
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x14], eax
push ebx
mov dword [esi + 0x18], edi
call fcn.00414630
push dword [ebp - 0x218]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x24], eax
call fcn.00414630
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
call fcn.00401db0
mov eax, dword [ebp - 0x210]
cmp eax, dword [0x463780]
je 0x4017fd
push dword [esi + 4]
call fcn.004146e0
push dword [esi + 0x1c]
call fcn.004146e0
push dword [esi + 0x28]
call fcn.004146e0
push esi
call fcn.0043198a
add esp, 4
jmp 0x401837
movzx eax, byte [0x4637cc]
push eax
lea eax, [ebp - 0x214]
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
call fcn.00402800
mov esi, dword [ebp - 0x214]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x40182b
call fcn.00404b60
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x401837
call fcn.00404b60
push dword [0x463784]
lea eax, [ebp - 0x20c]
push str._BackTrace_entries___d_r_n
push eax
call fcn.004027e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x463644
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x401880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x463644
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x240], esi
push eax
mov dword [ebp - 0x20c], 0
call fcn.00401db0
mov eax, dword [ebp - 0x20c]
cmp eax, dword [0x463780]
je 0x401933
mov esi, dword [eax + 0x10]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00401ae0
push dword [esi + 4]
call fcn.004146e0
push dword [esi + 0x1c]
call fcn.004146e0
push dword [esi + 0x28]
call fcn.004146e0
push esi
call fcn.0043198a
add esp, 4
push dword [0x463784]
lea eax, [ebp - 0x208]
push str._BackTrace_entries___d_r_n
push eax
call fcn.004027e0
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x463644
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x402d10
Capabilities:
Create directory
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xa
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x402f0d
mov ecx, eax
call fcn.00402f20
mov esi, eax
test esi, esi
je 0x402f0d
push ebx
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x20119
push ebx
push 0x456494
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 8]
test edi, edi
je 0x402de0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push 0x4564f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402dc3
push dword [ebp - 0xc]
call fcn.00432432
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x402dc3
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
push ebx
push 0x4564f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402db9
mov ebx, dword [ebp - 0x10]
jmp 0x402dc3
push 0
call fcn.004323fa
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x402de0
push ebx
push esi
call fcn.0043228c
add esp, 8
test eax, eax
je 0x402ef1
mov edx, esi
mov ecx, 2
call fcn.00415570
push 0xa
push 0x3e9
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x402e89
mov ecx, eax
call fcn.00402f20
mov ebx, eax
test ebx, ebx
je 0x402e89
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x456494
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [ebp - 8]
test edi, edi
je 0x402e80
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e46
sub ecx, edx
sar ecx, 1
add ecx, ecx
jne 0x402e67
push str.BrandingURL
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x402e79
push ecx
push ebx
push 1
push 0
push str.BrandingURL
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.004323fa
add esp, 4
cmp word [0x463bf8], 0
jne 0x402ea6
push 0x463bf8
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x44bdb8
push 0x463bf8
push 0x463e00
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, eax
test edi, edi
je 0x402ef1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x44b9d8
mov ecx, edi
call fcn.00415ac0
mov edi, eax
test edi, edi
je 0x402ef1
mov edx, edi
mov ecx, 0x3ea
call fcn.0040a670
push edi
call fcn.004323fa
add esp, 4
push esi
call fcn.004323fa
add esp, 4
mov al, 1
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x402f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push 0
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x402f99
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp byte [ebx], 0xff
jne 0x402f66
cmp byte [ebx + 1], 0xfe
jne 0x402f66
add ebx, 2
sub edi, 2
mov dword [ebp - 4], edi
lea esi, [edi + 2]
push esi
call fcn.00432432
push esi
mov edi, eax
push 0
push edi
call fcn.0043cf50
push dword [ebp - 4]
push ebx
push edi
call fcn.00433580
add esp, 0x1c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402fb0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.SYSTEMCurrentControlSet_services
lea eax, [ebp - 0x20c]
xor bl, bl
push 0x104
push eax
call fcn.0043256a
push 0x44ba3c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
push 0x44ba40
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
add esp, 0x24
lea eax, [ebp - 0x21c]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4030fc
push esi
lea eax, [ebp - 0x214]
push eax
push str.Instances
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4030df
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x16
push 0x44ba68
push 1
push 0
push str.DefaultInstance
push dword [ebp - 0x214]
call edi
lea eax, [ebp - 0x218]
push eax
push 0x44ba68
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4030d6
push 0xc
push str.345800
push 1
push eax
push str.Altitude
push dword [ebp - 0x218]
mov dword [ebp - 0x210], eax
call edi
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push 0
push str.Flags
push dword [ebp - 0x218]
call edi
push dword [ebp - 0x218]
call esi
mov bl, 1
push dword [ebp - 0x214]
call esi
pop edi
push dword [ebp - 0x21c]
call esi
pop esi
test bl, bl
je 0x4030fc
call fcn.00403110
test al, 1
je 0x4030fc
mov cl, 1
call fcn.00403200
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x403110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.SYSTEMCurrentControlSet_services
lea eax, [ebp - 0x20c]
mov esi, 1
push 0x104
push eax
call fcn.0043256a
push 0x44ba3c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
push 0x44ba40
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
push esi
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4031df
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 4
push eax
push 0
push 0
push str.NoCryptoGuard
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4031d3
mov eax, dword [ebp - 0x210]
neg eax
sbb eax, eax
not eax
and esi, eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403340
test al, al
je 0x4031ee
or esi, 0x80000000
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043183b
mov esp, ebp
pop ebp
ret

Function at 0x403200
Capabilities:
Check os version
Delete registry value
Get system information on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4622b4]
push ebx
xor bl, bl
mov bh, cl
cmp eax, 0xffffffff
jne 0x403257
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x2c]
cmp ax, 9
je 0x40326c
cmp ax, 6
je 0x40326c
mov dword [0x4622b4], 0
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x403276
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov dword [0x4622b4], 1
push 0x110
lea eax, [ebp - 0x13c]
push 0
push eax
call fcn.0043cf50
add esp, 0xc
mov dword [ebp - 0x140], 0x114
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403325
cmp dword [ebp - 0x13c], 6
jne 0x403325
cmp dword [ebp - 0x138], 1
jne 0x403325
lea eax, [ebp - 0x144]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSet_servicesLanmanServerParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403325
test bh, bh
je 0x403303
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
push str.EnableECP
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x403314
push str.EnableECP
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x144]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x403340
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4622b4]
cmp eax, 0xffffffff
jne 0x4033a9
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x28]
cmp ax, 9
jne 0x40337d
mov dword [0x4622b4], 1
jmp 0x4033ad
cmp ax, 6
jne 0x40338f
mov dword [0x4622b4], 1
jmp 0x4033ad
mov dword [0x4622b4], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x403404
push 0x110
lea eax, [ebp - 0x138]
push 0
push eax
call fcn.0043cf50
add esp, 0xc
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403404
mov eax, dword [ebp - 0x138]
cmp eax, 6
jbe 0x4033f9
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
jne 0x403404
cmp dword [ebp - 0x134], 1
jae 0x4033e9
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret

Function at 0x403420
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSet_services
push 0x104
push eax
xor bl, bl
mov dword [esi], ecx
call fcn.0043256a
push 0x44ba3c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
push 0x44ba40
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004325c6
add esp, 0x24
lea eax, [ebp - 0x214]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40350a
mov eax, dword [esi]
test eax, eax
jne 0x4034dc
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
push str.NoCryptoGuard
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4034fe
mov bl, 1
xor cl, cl
jmp 0x4034f9
test al, 1
je 0x4034fe
push str.NoCryptoGuard
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4034fe
mov bl, 1
mov cl, bl
call fcn.00403200
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403340
test al, al
je 0x403519
or dword [esi], 0x80000000
test bl, bl
je 0x40354c
push str.Driver::Stop_r_n
call fcn.00416f00
add esp, 4
xor cl, cl
call fcn.004044b0
call fcn.00404300
neg al
pop esi
sbb al, al
and al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x404300
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push str.Driver::Start_r_n
call fcn.00416f00
add esp, 4
xor bl, bl
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x404361
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov al, bl
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
push esi
push 0x14
push 0x44ba40
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x404397
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService
push 0x4566ac
call fcn.00416f00
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0xc
jmp 0x4043fa
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4043c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44bc34
push 0x4566ac
call fcn.00416f00
add esp, 0xc
jmp 0x4043f1
cmp dword [ebp - 0x1c], 4
je 0x4043f1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4043e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x4043e7
mov bl, 1
jmp 0x4043f1
mov ecx, str.StartService
call fcn.00416f60
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret

Function at 0x404410
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebx
push esi
push 2
push str.ServicesActive
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x404447
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov al, bl
pop esi
pop ebx
ret
push 0
push 0
push 0
push 0
push str.Base
push str.System32drivershmpalert.sys
push 1
push 2
push 1
push 0x10
push 0x44bca0
push 0x44ba40
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x404481
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404490
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x404490
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x4044a0
call fcn.00402fb0
pop esi
mov al, bl
pop ebx
ret
Function at 0x4044b0
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 4
push str.ServicesActive
push 0
mov byte [ebp - 0x2d], cl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x404503
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager
push 0x4566ac
call fcn.00416f00
add esp, 0xc
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp byte [ebp - 0x2d], 0
mov ecx, 0x24
mov dword [ebp - 0x34], eax
je 0x404520
mov ecx, 0x10024
push ecx
push 0x44ba40
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4045fe
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x404561
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ControlService__drv_
push 0x4566ac
call fcn.00416f00
add esp, 0xc
cmp dword [ebp - 0x28], 3
jne 0x4045cd
jmp 0x404570
mov eax, 0xcccccccd
mul dword [ebp - 0x14]
shr edx, 3
cmp edx, 0x3e8
jae 0x40458a
mov edx, 0x3e8
jmp 0x404597
cmp edx, 0x1388
jbe 0x404597
mov edx, 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4045cd
cmp dword [ebp - 0x28], 1
je 0x4045cd
call edi
sub eax, dword [ebp - 0x34]
cmp eax, 0x2710
ja 0x4045cd
cmp dword [ebp - 0x28], 3
je 0x404570
cmp byte [ebp - 0x2d], 0
je 0x4045f7
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4045f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService__drv_
push 0x4566ac
call fcn.00416f00
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret
Function at 0x404620
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
push str.ServicesActive
push 0
mov dword [ebp - 0x30], ecx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x404677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
push edi
push 4
push 0x44ba40
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4046d3
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4046be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x44bd30
push 0x4566ac
call fcn.00416f00
add esp, 0xc
jmp 0x4046cc
cmp dword [ebp - 0x28], 4
mov bl, 1
mov ecx, dword [ebp - 0x30]
sete al
mov byte [ecx], al
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret

Function at 0x4046f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
push dword [ebp + 8]
push edx
push ecx
push dword [0x463664]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov esi, eax
test esi, esi
jne 0x404743
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, 1
pop esi
sete al
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret

Function at 0x404760
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 2
push 0
push 0xd8
push 1
push 2
push dword [0x463664]
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov esi, eax
test esi, esi
jne 0x4047bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReportEvent
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, 1
pop esi
sete al
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret