joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4064b0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x406681
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x406680
cmp eax, 0x29
jne 0x4064e8
cmp dword [esi + 0x10], 0
jne 0x406680
test dword [esi + 0x50], 0x10000000
je 0x406685
cmp eax, 0x2e
jne 0x406545
push 5
lea ecx, [esi + 0x24]
call fcn.00409350
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x406539
cmp word [eax], 0x5c
jne 0x406536
add eax, 2
cmp eax, ecx
je 0x406536
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x406522
movzx edx, word [eax]
cmp edx, 0x28
je 0x406534
cmp edx, 0x29
je 0x406534
test cl, 0x10
jne 0x406536
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x406534
cmp ecx, 0x7d
jne 0x406536
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.00409c80
jmp 0x40666d
cmp eax, 0x5c
jne 0x4065ac
mov ecx, esi
call fcn.004093c0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x406578
cmp word [esi + 0x48], 0x62
jne 0x406578
push 4
lea ecx, [esi + 0x24]
call fcn.00409350
mov ecx, esi
call fcn.004093c0
jmp 0x406674
test eax, eax
je 0x4065a0
cmp word [esi + 0x48], 0x42
jne 0x4065a0
push 4
lea ecx, [esi + 0x24]
call fcn.00409350
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004093c0
jmp 0x406674
mov ecx, esi
call fcn.00406800
jmp 0x40666d
cmp eax, 0x5b
jne 0x4065cf
mov ecx, esi
call fcn.004093c0
mov ecx, esi
call fcn.00406e20
push 4
push 0x5d
mov ecx, esi
call fcn.004088e0
jmp 0x40666d
cmp eax, 0x28
jne 0x4065f9
mov ecx, esi
call fcn.004093c0
mov ecx, esi
call fcn.00409ec0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004088e0
test bl, bl
je 0x406674
jmp 0x40666d
cmp eax, 0x5e
jne 0x406611
push 2
lea ecx, [esi + 0x24]
call fcn.00409350
mov ecx, esi
call fcn.004093c0
jmp 0x406674
cmp eax, 0x24
jne 0x406629
push 3
lea ecx, [esi + 0x24]
call fcn.00409350
mov ecx, esi
call fcn.004093c0
jmp 0x406674
cmp eax, 0x2a
je 0x40669a
cmp eax, 0x2b
je 0x40669a
cmp eax, 0x3f
je 0x40669a
cmp eax, 0x7b
je 0x40669a
cmp eax, 0x7d
jne 0x40664b
test dword [esi + 0x50], 0x10000000
je 0x40668c
cmp eax, 0x5d
jne 0x406659
test dword [esi + 0x50], 0x10000000
je 0x406693
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00405a40
mov ecx, esi
call fcn.004093c0
mov ecx, esi
call fcn.00409410
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4064c0
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0041692b
push 6
call fcn.0041692b
push 4
call fcn.0041692b
push 0xa
call fcn.0041692b
int3
Function at 0x406790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4067a5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4067e6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4067e2
nop word [eax + eax]
cmp esi, edx
jae 0x4067e6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4067d0
cmp esi, edx
jb 0x4067eb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40a850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40a881
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40a870
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40da40
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43221b
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040e330
cmp eax, 0xffffffff
je 0x40da95
push str.explorer.exe
push eax
call fcn.0040e600
add esp, 8
cmp eax, 0xffffffff
jne 0x40da9c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x40dc14
push eax
call fcn.0040e560
mov esi, eax
add esp, 4
test esi, esi
je 0x40da95
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041ad60
push 0x208
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00412660
add esp, 0x18
test eax, eax
jne 0x40dae5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40dc14
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x450]
push eax
push esi
movups xmmword [ebp - 0x440], xmm0
mov dword [ebp - 0x450], 0x20
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x40dad7
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0041ad60
add esp, 0xc
lea ecx, [ebp - 0x42c]
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareGeneeGLogon
push dword [ebp - 0x434]
call fcn.0040de60
mov edi, eax
test edi, edi
jne 0x40dbac
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push str.gfs_ip
lea ecx, [ebp - 0x42c]
call fcn.0040fcf0
mov edi, eax
lea ecx, [ebp - 0x42c]
call fcn.0040ddc0
test edi, edi
jne 0x40dbce
lea eax, [ebp - 0x420]
push eax
call fcn.004044a0
add esp, 4
mov edi, eax
jmp 0x40dbd0
xor edi, edi
push dword [ebp - 0x434]
push esi
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.GlobalBF863074_0749_41E0_A410_1C8A8C2D507B
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x40dc07
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x42c]
call fcn.0040c0a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
Function at 0x40e020
Capabilities:
Disable system features via registry on windows
Impersonate user
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0040ecd0
test al, al
je 0x40e064
call fcn.0040e330
cmp eax, 0xffffffff
je 0x40e064
push str.explorer.exe
push eax
call fcn.0040e600
add esp, 8
cmp eax, 0xffffffff
jne 0x40e074
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.0040e560
mov esi, eax
add esp, 4
test esi, esi
je 0x40e0f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041ad60
push 0x208
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00412660
add esp, 0x18
test eax, eax
je 0x40e0e9
xorps xmm0, xmm0
lea eax, [ebp - 0x20c]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x23c]
push eax
push esi
movups xmmword [ebp - 0x22c], xmm0
mov dword [ebp - 0x23c], 0x20
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x40e101
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push dword [ebp - 0x220]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call fcn.0040de60
mov edi, eax
test edi, edi
jne 0x40e174
cmp dword [ebp + 8], eax
push 4
setne al
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 4
push edi
push str.DisableTaskMgr
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
lea ecx, [ebp - 0x218]
call fcn.0040ddc0
push dword [ebp - 0x220]
push esi
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
call fcn.0040c0a0
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
Function at 0x40e330
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e3a1
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x40e3a1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 0
push eax
push 8
push esi
push 0
mov edi, 4
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x40e390
mov eax, dword [ebp - 4]
push eax
mov edi, dword [eax]
call sub.WTSAPI32.dll_WTSFreeMemory
test edi, edi
sete al
test al, al
je 0x40e3a1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push 0
or edi, 0xffffffff
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x40e407
mov edx, dword [ebp - 8]
xor eax, eax
mov esi, dword [ebp - 0xc]
test edx, edx
je 0x40e3f9
lea ecx, [esi + 8]
cmp dword [ecx], 0
je 0x40e3f3
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x40e3d8
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4]
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40eae0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
mov dword [ebp - 0xa14], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40eb4b
push 1
lea ecx, [ebx + 0x40]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40eb3b
push eax
mov dword [ebp - 0xa14], 1
call esi
push edi
call esi
cmp dword [ebp - 0xa14], 0
jne 0x40ec95
push 0x104
lea eax, [ebp - 0x20e]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ec06
cmp eax, 0x104
je 0x40ec06
mov ecx, 0x22
mov word [ebp - 0x210], cx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x40ecab
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x210], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40ec19
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.0040d1b0
add esp, 0xc
test eax, eax
jne 0x40ebf1
push str.Could_not_open_Service_Manager
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.0041dea4
push eax
call fcn.00404260
add esp, 0x10
push 0
lea eax, [ebx + 0x40]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
add ebx, 0x40
push eax
push 1
push 3
push 0x10
push 0xf01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x40ec8f
push edi
call esi
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80b
call fcn.0040d1b0
add esp, 0xc
test eax, eax
jne 0x40ec87
push str.Could_not_start_service
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.0041dea4
push eax
call fcn.00404260
add esp, 0x10
push 0
push ebx
jmp 0x40ebf7
push eax
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
call fcn.00417fd3
int3

Function at 0x40ecd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x44779e], 0
jne 0x40ed61
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041ad60
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x40ed45
cmp dword [ebp - 0x118], 2
jb 0x40ed45
mov al, 1
mov byte [0x44779f], al
mov byte [0x44779e], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [0x44779e], 1
mov byte [0x44779f], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x44779f]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
Function at 0x40ed80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4477a0], 0
jne 0x40eded
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0041ad60
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov byte [0x4477a0], 1
setae al
mov byte [0x4477a1], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x4477a1]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret

Function at 0x40ee00
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push 0xff
push 0x100
push eax
call fcn.0040b730
push dword [eax + 4]
push dword [eax]
call fcn.00420bb2
xor eax, eax
add esp, 0x20
cmp dword [esi + 0x260], 0
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], eax
jne 0x40ee67
push eax
call fcn.00420f2a
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40ee9c
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00417e4f
mov esp, ebp
pop ebp
ret

Function at 0x40fcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fd61
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40fd2f
cmp eax, 2
jne 0x40fd4b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40fd5b
test ecx, ecx
je 0x40fd56
test cl, 1
jne 0x40fd4b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40fd5b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40fec0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
call fcn.00411cd0
test eax, eax
jne 0x40fede
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], str.APPID
push eax
push 1
push 0x65
push dword [0x4474a4]
mov dword [ebp - 0xc], str.90F867A1_1173_432C_9AF7_49CE717A1FC8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.004121b0
test eax, eax
js 0x40fffd
push ebx
push edi
push 0x20006
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0040f300
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x40ff60
push eax
call fcn.0040d190
add esp, 4
mov esi, eax
jmp 0x40fff2
push 0
push 0
push 0x2001f
push 0
push 0
push str.90F867A1_1173_432C_9AF7_49CE717A1FC8
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0040de60
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x40ffa4
push eax
call fcn.0040d190
add esp, 4
mov esi, eax
jmp 0x40ffdd
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [ebp + 8], 0
je 0x40ffdb
push 1
lea eax, [esi + 0x40]
push eax
push str.LocalService
lea ecx, [ebp - 0xc]
call fcn.00411360
mov ecx, esi
call fcn.0040eae0
test eax, eax
jne 0x40ffdb
mov esi, 0x80004005
jmp 0x40ffdd
xor esi, esi
test edi, edi
je 0x40ffec
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x40fff2
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x40fff9
push ebx
call edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x410010
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040fec0
mov edi, eax
test edi, edi
jne 0x410077
push ebx
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf01ff
lea ecx, [esi + 0x40]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x410068
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x410250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432296
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4460f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4102fc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4102fc
call fcn.0040d170
mov esi, eax
jmp 0x4103ec
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x41031f
call fcn.0040d170
jmp 0x4103df
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x41033d
call fcn.0040d170
jmp 0x4103df
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x41035e
mov esi, 0x8007000e
jmp 0x4103e1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040cd50
jmp 0x410388
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x41039f
mov esi, 0x8007000e
jmp 0x4103e1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4103bf
call fcn.0040d170
jmp 0x4103df
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00410080
mov esi, eax
test edi, edi
je 0x4103ec
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x410410
lea ecx, [ebp - 0x418]
call fcn.0040e260
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00417e4f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410d40
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.0040f6a0
test eax, eax
jne 0x410d5e
cmp byte [esi + 0x3c], al
jne 0x410d5e
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
push 0
push 0
push 0
push 0x412800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esi + 0x268]
mov dword [esi + 0x278], eax
call fcn.004116c0
test eax, eax
jne 0x410d91
mov ecx, esi
call fcn.00410dc0
jmp 0x410d93
js 0x410dac
push 0
push dword [esi + 0x278]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esi + 0x268]
call fcn.00412040
pop edi
pop esi
pop ebp
ret 4

Function at 0x4111d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4111e9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4111f5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4111f0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x411360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x411375
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411380
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x411610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x411631
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x40f0e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x41165a
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x30], edi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411f60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00411cd0
test eax, eax
jne 0x411f78
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0x20006
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0040f300
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0xc]
test eax, eax
je 0x411fc1
push eax
call fcn.0040d190
add esp, 4
mov esi, eax
jmp 0x412025
push 0x20006
push str.90F867A1_1173_432C_9AF7_49CE717A1FC8
push ebx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0040f300
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x411ffb
push eax
call fcn.0040d190
add esp, 4
jmp 0x41200e
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0
call fcn.00412170
mov esi, eax
test edi, edi
je 0x41201f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x412025
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41202c
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret