joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ea0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 0x55be7a
call fcn.0051a674
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea ecx, [ebp + 8]
call fcn.004100c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409f01
mov byte [ebp - 2], 0
lea ecx, [ebp + 8]
call fcn.0040fee0
lea ecx, [ebp + 0x10]
call fcn.0040fee0
mov al, byte [ebp - 2]
jmp 0x409f91
lea ecx, [ebp + 0x10]
call fcn.004100c0
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x409f22
jmp 0x409f6e
mov ecx, dword [ebp - 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x409f39
jmp 0x409f6e
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409f66
jmp 0x409f6e
mov byte [ebp - 1], 1
xor ecx, ecx
jne 0x409f01
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
lea ecx, [ebp + 8]
call fcn.0040fee0
lea ecx, [ebp + 0x10]
call fcn.0040fee0
mov al, byte [ebp - 3]
mov esp, ebp
pop ebp
ret
Function at 0x40a360
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov ecx, 0x55be7a
call fcn.0051a674
push 0
push 0x80
push 3
push 0
push 1
push connect
mov ecx, dword [ebp + 8]
call fcn.004100c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40a3a4
xor eax, eax
jmp 0x40a4fe
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0x538ff4
push 0x200000
call fcn.004ec440
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x40a3f4
xor eax, eax
jmp 0x40a4fe
mov dword [ebp - 0xc], 0
call fcn.00407cf0
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x44c]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.00411c30
cmp dword [ebp - 0x10], 0
jl 0x40a4df
jg 0x40a428
cmp dword [ebp - 0x14], 0
jbe 0x40a4df
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
jg 0x40a44e
jl 0x40a440
cmp dword [ebp - 0x14], 0x200000
jae 0x40a44e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x40a45a
xor edx, edx
mov dword [ebp - 0x28], 0x200000
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a47e
jmp 0x40a4df
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sbb edx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
jne 0x40a4bc
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00412620
add esp, 0xc
mov dword [ebp - 0xc], eax
jmp 0x40a4da
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x44c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004126a0
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x40a412
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.004ec0d1
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x40a510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, 0x55be7a
call fcn.0051a674
lea ecx, [ebp - 0x30]
call fcn.00403fb0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [ebp + 8]
call fcn.004100c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40a562
jmp 0x40a5b3
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
call fcn.00403d10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
call fcn.00403d30
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40a5ad
mov ecx, dword [ebp + 0xc]
call fcn.00403d10
cmp dword [ebp - 8], eax
je 0x40a5af
jmp 0x40a5b3
xor ecx, ecx
jne 0x40a536
cmp dword [ebp - 4], 0xffffffff
je 0x40a5c3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
call fcn.00403e90
lea ecx, [ebp + 8]
call fcn.0040fee0
mov esp, ebp
pop ebp
ret
Function at 0x40b5d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ad2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, 0x55be7a
call fcn.0051a674
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 1
lea eax, [ebp + 8]
push eax
push 0x54407c
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0040f550
add esp, 0xc
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 2
push 0x544078
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040f600
add esp, 0xc
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp + 8]
call fcn.0040feb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.0040fee0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040fee0
push 0x3c
push 0
lea ecx, [ebp - 0x70]
push ecx
call fcn.004efcf0
add esp, 0xc
mov dword [ebp - 0x70], 0x3c
movzx edx, byte [ebp + 0x1c]
test edx, edx
je 0x40b69e
mov dword [ebp - 0x6c], 0x440
jmp 0x40b6a5
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
lea ecx, [ebp + 8]
call fcn.004100c0
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0xc]
call fcn.004100c0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40b6e1
mov dword [ebp - 0x54], 5
jmp 0x40b6e8
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp + 0x14], 0
je 0x40b70e
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x40b732
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040fee0
mov eax, dword [ebp - 0x30]
jmp 0x40b77b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b790
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ad61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
add esp, 0xfffffd30
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov ecx, 0x55be7a
call fcn.0051a674
push 0x208
push 0
lea eax, [ebp - 0x2c8]
push eax
call fcn.004efcf0
add esp, 0xc
lea ecx, [ebp - 0x2c8]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x2c8]
push edx
mov ecx, dword [ebx + 8]
call fcn.0040ff80
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov byte [ebp - 0x21], cl
xor edx, edx
mov byte [ebp - 0x22], dl
xor eax, eax
mov byte [ebp - 0x23], al
movzx ecx, byte [ebp - 0x21]
push ecx
movzx edx, byte [ebp - 0x22]
push edx
movzx eax, byte [ebp - 0x23]
push eax
lea ecx, [ebp - 0xc0]
call fcn.00413460
mov ecx, eax
call fcn.0040da30
push eax
mov ecx, dword [ebx + 8]
call fcn.0040fd90
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40b880
Capabilities:
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51adb9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
add esp, 0xfffffcf0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov ecx, 0x55be7a
call fcn.0051a674
mov eax, dword [ebx + 8]
push eax
call fcn.0040b790
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
or ecx, 1
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40ba5f
lea edx, [ebp - 0x28]
push edx
call fcn.00408630
add esp, 4
mov dword [ebp - 4], 1
push 0x208
push 0
lea eax, [ebp - 0x308]
push eax
call fcn.004efcf0
add esp, 0xc
mov dword [ebp - 0x38], 0x104
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x308]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ff80
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00410080
movzx ecx, al
test ecx, ecx
jne 0x40ba47
lea ecx, [ebp - 0x2c]
call fcn.00410080
movzx edx, al
test edx, edx
jne 0x40ba47
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040f490
add esp, 8
movzx edx, al
test edx, edx
je 0x40ba47
lea eax, [ebp - 0x34]
push eax
call fcn.00408b50
add esp, 4
mov byte [ebp - 4], 3
xor ecx, ecx
mov byte [ebp - 0x21], cl
xor edx, edx
mov byte [ebp - 0x22], dl
xor eax, eax
mov byte [ebp - 0x23], al
movzx ecx, byte [ebp - 0x21]
push ecx
movzx edx, byte [ebp - 0x22]
push edx
movzx eax, byte [ebp - 0x23]
push eax
lea ecx, [ebp - 0x100]
call fcn.00413630
mov ecx, eax
call fcn.0040d0e0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.0040f6b0
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.0040f600
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebx + 8]
call fcn.0040feb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
call fcn.0040fee0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.0040fee0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.0040fee0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0040fee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040fee0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40ba80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a86d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
mov dword [ebp - 0x10], 0
mov ecx, 0x55be7a
call fcn.0051a674
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40bad6
mov eax, dword [ebp + 8]
push eax
call fcn.00408130
add esp, 4
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
jmp 0x40bb6b
lea ecx, [ebp - 0x14]
call fcn.00410030
mov dword [ebp - 4], 0
push 0x800
push 0
lea edx, [ebp - 0x814]
push edx
call fcn.004efcf0
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x814]
push eax
call fcn.004efcf0
add esp, 0xc
push 0
push 0x10
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40bb44
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040fe80
push 0x544080
lea ecx, [ebp - 0x14]
call fcn.0040fd90
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410000
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040fee0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40be90
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ae2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov ecx, 0x55be7a
call fcn.0051a674
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x52b8a0
push 1
push 0
push 0x52b910
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40c00b
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
push 0x52b8c0
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40bffd
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
call fcn.004100c0
mov dword [ebp - 0x24], eax
push 2
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40bfef
push 0x5c
mov ecx, dword [ebp + 0xc]
call fcn.0040fa00
push eax
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040f760
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp + 0xc]
call fcn.004100c0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1c]
call fcn.004100c0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0xc]
call fcn.004100c0
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x44], edx
push 1
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040fee0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 8]
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c030
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, 0x55be7a
call fcn.0051a674
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40c062
lea ecx, [ebp + 8]
call fcn.0040fee0
jmp 0x40c0cd
push 0xf01ff
lea ecx, [ebp + 8]
call fcn.004100c0
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c097
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp + 8]
call fcn.0040fee0
jmp 0x40c0cd
lea edx, [ebp - 0x24]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp + 8]
call fcn.0040fee0
mov esp, ebp
pop ebp
ret

Function at 0x40c0e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ae4d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov ecx, 0x55be7a
call fcn.0051a674
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x40c1d2
lea eax, [ebp - 0x18]
push eax
call fcn.00408630
add esp, 4
mov dword [ebp - 4], 0
push 0x208
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.004efcf0
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040ff80
lea ecx, [ebp - 0x18]
call fcn.00410080
movzx edx, al
test edx, edx
jne 0x40c1bb
lea ecx, [ebp - 0x14]
call fcn.00410080
movzx eax, al
test eax, eax
jne 0x40c1bb
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.0040f490
add esp, 8
movzx eax, al
test eax, eax
je 0x40c1bb
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x14]
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040fee0
mov al, byte [ebp - 0xd]
jmp 0x40c1d4
lea ecx, [ebp - 0x14]
call fcn.0040fee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040fee0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c440
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51aeb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x6c
push esi
mov dword [ebp - 4], 0
mov ecx, 0x55be7a
call fcn.0051a674
call fcn.00407c90
movzx eax, al
test eax, eax
je 0x40c4d6
push 0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x2c], esp
lea ecx, [ebx + 8]
call fcn.004100c0
push eax
mov ecx, esi
call fcn.00405310
call fcn.004240c0
add esp, 0x1c
push 1
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x30], esp
lea ecx, [ebx + 8]
call fcn.004100c0
push eax
mov ecx, esi
call fcn.00405310
call fcn.004240c0
add esp, 0x1c
jmp 0x40c578
lea ecx, [ebx + 8]
call fcn.004100c0
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov byte [ebp - 0x11], cl
xor edx, edx
mov byte [ebp - 0x12], dl
xor eax, eax
mov byte [ebp - 0x13], al
movzx ecx, byte [ebp - 0x11]
push ecx
movzx edx, byte [ebp - 0x12]
push edx
movzx eax, byte [ebp - 0x13]
push eax
lea ecx, [ebp - 0x50]
call fcn.00413940
mov ecx, eax
call fcn.0040cc20
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebx + 8]
call fcn.004100c0
mov dword [ebp - 0x24], eax
xor eax, eax
mov byte [ebp - 0x14], al
xor ecx, ecx
mov byte [ebp - 0x15], cl
xor edx, edx
mov byte [ebp - 0x16], dl
movzx eax, byte [ebp - 0x14]
push eax
movzx ecx, byte [ebp - 0x15]
push ecx
movzx edx, byte [ebp - 0x16]
push edx
lea ecx, [ebp - 0x70]
call fcn.004139d0
mov ecx, eax
call fcn.0040cc20
mov dword [ebp - 0x28], eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 8]
call fcn.0040fee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40c9b0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov ecx, 0x55be7a
call fcn.0051a674
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 1], 1
cmp dword [ebp + 8], 0
jne 0x40c9db
xor al, al
jmp 0x40cae0
mov dword [ebp - 0x2c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40cac9
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x234]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dx, word [ecx]
mov word [ebp - 0xe], dx
mov eax, dword [ebp - 0xc]
cmp dx, word [eax]
jne 0x40ca6b
cmp word [ebp - 0xe], 0
je 0x40ca62
mov ecx, dword [ebp - 8]
mov dx, word [ecx + 2]
mov word [ebp - 0x10], dx
mov eax, dword [ebp - 0xc]
cmp dx, word [eax + 2]
jne 0x40ca6b
add dword [ebp - 8], 4
add dword [ebp - 0xc], 4
cmp word [ebp - 0x10], 0
jne 0x40ca26
mov dword [ebp - 0x1c], 0
jmp 0x40ca73
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x40cab0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x28], eax
push 1
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x40cab0
mov byte [ebp - 1], 0
jmp 0x40cac9
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x20], eax
jmp 0x40ca0d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0xffffffff
jne 0x40cadd
xor al, al
jmp 0x40cae0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4173d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov ecx, 0x55b38d
call fcn.0051a674
xor eax, eax
jne 0x4173e3
cmp dword [ebp + 0xc], 0
je 0x4173f6
mov dword [ebp - 0xc], 1
jmp 0x4173fd
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x417410
mov eax, 0xd
jmp 0x417465
xor edx, edx
jne 0x4173e7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x417423
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc