joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025da
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
shr ecx, 7
jmp 0x4025fa
movdqa xmm0, xmmword [esi]
movdqa xmm1, xmmword [esi + 0x10]
movdqa xmm2, xmmword [esi + 0x20]
movdqa xmm3, xmmword [esi + 0x30]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm1
movdqa xmmword [edi + 0x20], xmm2
movdqa xmmword [edi + 0x30], xmm3
movdqa xmm4, xmmword [esi + 0x40]
movdqa xmm5, xmmword [esi + 0x50]
movdqa xmm6, xmmword [esi + 0x60]
movdqa xmm7, xmmword [esi + 0x70]
movdqa xmmword [edi + 0x40], xmm4
movdqa xmmword [edi + 0x50], xmm5
movdqa xmmword [edi + 0x60], xmm6
movdqa xmmword [edi + 0x70], xmm7
lea esi, [esi + 0x80]
lea edi, [edi + 0x80]
dec ecx
jne 0x4025fa
jmp loc.00430c93

Function at 0x402794
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push ebx
pushfd
pop eax
mov ecx, eax
xor eax, 0x200000
push eax
popfd
pushfd
pop edx
sub edx, ecx
je 0x4027d9
push ecx
popfd
xor eax, eax
cpuid
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov eax, 1
jmp loc.00430a5e
pop ebx
test dword [ebp - 4], 0x4000000
je 0x4027f1
call fcn.00402744
test eax, eax
je 0x4027f1
xor eax, eax
inc eax
jmp 0x4027f3
xor eax, eax
pop ebx
leave
ret

Function at 0x402f22
Capabilities:
Packed with generic packer

Disassembly:
push 3
call fcn.00404d43
pop ecx
cmp eax, 1
je 0x402f44
push 3
call fcn.00404d43
pop ecx
test eax, eax
jne 0x402f5a
cmp dword [0x40b118], 1
jne 0x402f5a
jmp 0x4305d8
ret

Function at 0x4030bc
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
cmp dword [0x40c92c], edi
jne fcn.004030cf
jmp loc.0043022a

Function at 0x403393
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x40c92c], ebx
jne fcn.004033ad
jmp loc.00430b19

Function at 0x403a73
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x40b228]
mov edi, eax
call fcn.0040391b
call eax
mov esi, eax
test esi, esi
jne 0x403ae0
push 0x214
push 1
jmp loc.00430432
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
ret

Function at 0x4049b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403897
and dword [ebp - 4], 0
cmp dword [0x40c690], 0
mov ebx, eax
jmp loc.0042ffa6

Function at 0x404e80
Capabilities:
Packed with generic packer

Disassembly:
sub eax, 0x3a4
je 0x404ea9
sub eax, 4
je 0x404ea3
sub eax, 0xd
je 0x404e9d
dec eax
je 0x404e97
xor eax, eax
ret
mov eax, 0x404
ret
jmp loc.0042fd43
mov eax, 0x804
ret
mov eax, 0x411
ret
Function at 0x4055f1
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push dword [ebp + 8]
call fcn.00406e27
mov edi, eax
pop ecx
test edi, edi
jne 0x405630
jmp loc.0042fe03
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x405819
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edi
mov edi, dword [ebp + 8]
push edi
call esi
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x40583a
push eax
call esi
jmp loc.004304ea
Function at 0x100012d0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10001331
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1000135d
lea edx, [ebp - 0x18]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x10001331
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1000133f
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [ebp - 0xd], bl
je 0x1000135d
cmp dword [ebp - 0x18], ebx
je 0x1000135d
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ea8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10003ea8
mov esp, ebp
pop ebp
ret

Function at 0x10001540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.10004330
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100014b0
test al, al
je 0x100015a3
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call fcn.10003ec0
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x1004]
push 0xfff
push eax
call fcn.10003e8b
add esp, 0x1c
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ea8
mov esp, ebp
pop ebp
ret

Function at 0x100015c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.10004330
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100014b0
test al, al
je 0x10001629
xor eax, eax
push 0x1ffe
push eax
lea ecx, [ebp - 0x2002]
push ecx
mov word [ebp - 0x2004], ax
call fcn.10003ec0
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
push 0x1000
lea ecx, [ebp - 0x2004]
push 0x1000
push ecx
call fcn.1000430a
add esp, 0x20
lea edx, [ebp - 0x2004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ea8
mov esp, ebp
pop ebp
ret
Function at 0x10001d50
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10001d60
xor al, al
pop esi
pop ebp
ret
push edi
push 2
push 0
push 0
mov byte [ebp + 0xb], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x10001dbe
push ebx
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x10001dba
push 0
push 0x1001559a
push str..LocalSystem
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x10001db7
mov byte [ebp + 0xb], 1
push esi
call ebx
push edi
call ebx
pop ebx
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebp
ret

Function at 0x10001dd0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10001e45
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10001e45
push edi
push 2
push 0
push 0
mov byte [ebp + 0xb], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x10001e3d
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x10001e36
push 0
push ebx
push str.NT_AUTHORITYNetworkService
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x10001e2f
mov byte [ebp + 0xb], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x10001e50
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 5
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, esi
jne 0x10001e72
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
push esi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push esi
push esi
push 1
push 0x30
push esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call ebx
test eax, eax
jne 0x10001ec8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x10001eaf
cmp eax, 0xea
jne 0x10001f03
mov eax, dword [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10001f03
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call fcn.10003ec0
add esp, 0xc
push 0
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push 1
push 0x30
push 0
push edi
call ebx
test eax, eax
je 0x10001f03
mov eax, dword [ebp - 8]
test eax, eax
je 0x10001f03
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001f30
Capabilities:
Acquire debug privileges
Impersonate user
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x48
test eax, eax
je 0x10002080
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
test eax, eax
jne 0x10001f68
mov eax, dword [ebp + 8]
push str.StartService_User_Password__ServiceName_
push eax
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
jmp 0x10001f70
test eax, eax
je 0x10001f91
movzx ecx, si
push 0x10015674
push 0
mov dword [ebp + ecx*4 - 0x48], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x10001f70
cmp si, 2
pop esi
je 0x10001fad
mov edx, dword [ebp + 8]
push str.reboot_User_Password
push edx
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
call fcn.10001230
test al, al
jne 0x10002027
call fcn.100012d0
test al, al
jne 0x10002027
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
lea eax, [ebp + 0xc]
push eax
push 0
push 3
push ecx
push 0x1001562c
push edx
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10001fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push str.LogonUserA___d
push eax
call fcn.100010a0
add esp, 0xc
jmp 0x10002072
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10002027
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.ImpersonateLoggedOnUser___d
push edx
call fcn.100010a0
add esp, 0xc
jmp 0x10002072
push 1
push str.SeDebugPrivilege
call fcn.10001370
push 1
push str.SeShutdownPrivilege
call fcn.10001370
add esp, 0x10
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x1000205b
mov eax, dword [ebp + 8]
push str.Rebooting
push eax
jmp 0x10002064
mov ecx, dword [ebp + 8]
push str.Fail_To_Reboot
push ecx
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002080
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10002090
Capabilities:
Acquire debug privileges
Impersonate user
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x4c
test eax, eax
je 0x10002277
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
test eax, eax
jne 0x100020c8
mov eax, dword [ebp + 8]
push str.StartService_User_Password__ServiceName_
push eax
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
jmp 0x100020d0
test eax, eax
je 0x100020f1
movzx ecx, si
push 0x10015674
push 0
mov dword [ebp + ecx*4 - 0x4c], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x100020d0
cmp si, 3
je 0x10002113
cmp si, 2
je 0x10002118
mov edx, dword [ebp + 8]
push str.StartService_User_Password__ServiceName_
push edx
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x44]
jmp 0x10002134
mov eax, 0x10020690
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002120
sub eax, edx
je 0x10002265
mov esi, 0x10020690
mov dword [ebp + 0xc], 0
call fcn.10001230
test al, al
jne 0x100021b4
call fcn.100012d0
test al, al
jne 0x100021b4
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
lea eax, [ebp + 0xc]
push eax
push 0
push 3
push ecx
push 0x1001562c
push edx
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10002189
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push str.LogonUserA___d
push eax
call fcn.100010a0
add esp, 0xc
jmp 0x10002252
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x100021b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.ImpersonateLoggedOnUser___d
push edx
call fcn.100010a0
add esp, 0xc
jmp 0x10002252
push edi
push 1
push str.SeDebugPrivilege
call fcn.10001370
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x100021ec
mov eax, dword [ebp + 8]
push str.OpenSCManager_Failure
push eax
call fcn.100010a0
add esp, 8
jmp 0x10002251
push ebx
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x10002219
mov ecx, dword [ebp + 8]
push str.OpenService_Failure
push ecx
call fcn.100010a0
add esp, 8
jmp 0x1000224d
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x10002233
mov edx, dword [ebp + 8]
push str.Start_Service_Success
push edx
jmp 0x1000223c
mov eax, dword [ebp + 8]
push str.Start_Service_Failure
push eax
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call ebx
push edi
call ebx
pop ebx
pop edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002276
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push str.Service_Name_Hasnt_Set
push ecx
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002280
Capabilities:
Acquire debug privileges
Create service
Impersonate user
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x4c
test eax, eax
je 0x10002467
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
test eax, eax
jne 0x100022b8
mov eax, dword [ebp + 8]
push str.AddService_User_Password__ServiceName__Path
push eax
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
jmp 0x100022c0
test eax, eax
je 0x100022e1
movzx ecx, si
push 0x10015674
push 0
mov dword [ebp + ecx*4 - 0x4c], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x100022c0
push ebx
cmp si, 4
je 0x10002305
cmp si, 3
je 0x1000230d
mov edx, dword [ebp + 8]
push str.AddService_User_Password__ServiceName__Path
push edx
call fcn.100010a0
add esp, 8
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
jmp 0x1000232c
mov ebx, dword [ebp - 0x44]
mov eax, 0x10020690
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002318
sub eax, edx
je 0x10002454
mov esi, 0x10020690
mov dword [ebp + 0xc], 0
call fcn.10001230
test al, al
jne 0x100023ac
call fcn.100012d0
test al, al
jne 0x100023ac
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
lea eax, [ebp + 0xc]
push eax
push 0
push 3
push ecx
push 0x1001562c
push edx
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10002381
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push str.LogonUserA___d
push eax
call fcn.100010a0
add esp, 0xc
jmp 0x10002440
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x100023ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.ImpersonateLoggedOnUser___d
push edx
call fcn.100010a0
add esp, 0xc
jmp 0x10002440
push edi
push 1
push str.SeDebugPrivilege
call fcn.10001370
add esp, 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x100023e1
mov eax, dword [ebp + 8]
push str.OpenSCManager_Failure
push eax
call fcn.100010a0
add esp, 8
jmp 0x1000243f
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
push 2
push 0x110
push 0xf01ff
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x10002422
mov ecx, dword [ebp + 8]
push str.CreateService_Failure
push ecx
call fcn.100010a0
add esp, 8
jmp 0x1000243c
mov edx, dword [ebp + 8]
push str.Create_Service_Success
push edx
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call ebx
push edi
call ebx
pop edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10002465
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push str.Service_Name_Hasnt_Set
push eax
call fcn.100010a0
add esp, 8
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10002520
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10002520
xor eax, eax
test edx, edx
je 0x10002520
xor byte [eax + ecx], 7
inc eax
cmp eax, edx
jb 0x10002517
pop ebp
ret
Function at 0x10002570
Capabilities:
Create directory
Impersonate user

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x48
test eax, eax
je 0x10002746
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
test eax, eax
jne 0x100025a8
mov eax, dword [ebp + 8]
push str.AddService_User_Password__ServiceName__Path
push eax
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
jmp 0x100025b0
test eax, eax
je 0x100025d1
movzx ecx, si
push 0x10015674
push 0
mov dword [ebp + ecx*4 - 0x48], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x100025b0
cmp si, 3
je 0x100025ed
mov edx, dword [ebp + 8]
push str.MD_User_Password_Path
push edx
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x40]
mov eax, esi
mov dword [ebp + 0xc], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002600
sub eax, edx
cmp eax, 3
jae 0x10002624
mov eax, dword [ebp + 8]
push str.Directory_Must_In_Full_Path
push eax
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi + 1], 0x3a
je 0x10002640
mov ecx, dword [ebp + 8]
push str.Invalid_Directory
push ecx
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10001230
test al, al
jne 0x100026b9
call fcn.100012d0
test al, al
jne 0x100026b9
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
lea edx, [ebp + 0xc]
push edx
push 0
push 3
push eax
push 0x1001562c
push ecx
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x1000268e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.LogonUserA___d
push edx
call fcn.100010a0
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x100026b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push str.ImpersonateLoggedOnUser___d
push ecx
call fcn.100010a0
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100026e3
mov edx, dword [ebp + 8]
push esi
push str.Create_Directory__s_Successfully
push edx
call fcn.100010a0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1000272e
cmp eax, 0xb7
je 0x10002711
mov eax, dword [ebp + 8]
push str.Fail_To_Create_Directory
push eax
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
push str._s_Already_Exists
push ecx
call fcn.100010a0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push str.One_Or_More_Intermediate_Directories_Do_Not_Exist
push edx
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002860
Capabilities:
Acquire debug privileges
Impersonate user

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x50
test eax, eax
je 0x100029cf
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
test eax, eax
jne 0x10002898
mov eax, dword [ebp + 8]
push str.ChangePwd__User___Password__Account_NewPassword
push eax
call fcn.100010a0
add esp, 8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
jmp 0x100028a0
test eax, eax
je 0x100028c1
movzx ecx, si
push 0x10015674
push 0
mov dword [ebp + ecx*4 - 0x50], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x100028a0
cmp si, 2
je 0x100028e3
cmp si, 4
je 0x100028e3
mov edx, dword [ebp + 8]
push str.ChangePwd__User___Password__Account_NewPassword
push edx
call fcn.100010a0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push ebx
movzx eax, si
xor ecx, ecx
push edi
xor edi, edi
xor ebx, ebx
sub eax, 2
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ecx
je 0x1000290c
sub eax, 2
jne 0x10002918
mov edi, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
jmp 0x10002912
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov dword [ebp + 0xc], edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
call fcn.10001230
test al, al
jne 0x10002998
call fcn.100012d0
test al, al
jne 0x10002998
test edi, edi
je 0x100029be
test ebx, ebx
je 0x100029be
lea eax, [ebp - 8]
push eax
push 0
push 3
push ebx
push 0x1001562c
push edi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10002970
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push str.LogonUserA___d
push ecx
call fcn.100010a0
add esp, 0xc
jmp 0x100029be
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10002998
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push str.ImpersonateLoggedOnUser___d
push eax
call fcn.100010a0
add esp, 0xc
jmp 0x100029be
push 1
push str.SeDebugPrivilege
call fcn.10001370
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.10002750
add esp, 0x14
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 8]
pop edi
pop ebx
test eax, eax
je 0x100029ce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret