joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18030aac
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x18030aee
call fcn.18030d20
mov ecx, esi
cmp eax, 0xef
jne 0x18030ae9
call fcn.18030d20
cmp eax, 0xbb
jne 0x18030add
mov ecx, esi
call fcn.18030d20
cmp eax, 0xbf
je 0x18030aee
mov dword [esi + 0x40], str.invalid_BOM__must_be_0xEF_0xBB_0xBF_if_given
push 0xe
pop eax
pop esi
ret
call fcn.180317e7
mov ecx, esi
call fcn.18030d20
mov eax, dword [esi + 8]
cmp eax, 0x20
je 0x18030aee
cmp eax, 9
je 0x18030aee
cmp eax, 0xa
je 0x18030aee
cmp eax, 0xd
je 0x18030aee
cmp eax, 0x36
jg 0x18030b67
je 0x18030b36
cmp eax, 0x30
jg 0x18030b4e
je 0x18030b36
cmp eax, 0xffffffff
je 0x18030b4a
test eax, eax
je 0x18030b4a
cmp eax, 0x22
je 0x18030b42
cmp eax, 0x2c
je 0x18030b3e
cmp eax, 0x2d
jne 0x18030bb6
mov ecx, esi
pop esi
jmp fcn.18030dcb
push 0xd
jmp 0x18030ae6
mov ecx, esi
pop esi
jmp fcn.18031191
push 0xf
jmp 0x18030ae6
sub eax, 0x31
je 0x18030b36
sub eax, 1
je 0x18030b36
sub eax, 1
je 0x18030b36
sub eax, 1
je 0x18030b36
sub eax, 1
jmp 0x18030b30
cmp eax, 0x5d
jg 0x18030b9c
je 0x18030b95
sub eax, 0x37
je 0x18030b36
sub eax, 1
je 0x18030b36
sub eax, 1
je 0x18030b36
sub eax, 1
je 0x18030b8e
sub eax, 0x21
jne 0x18030bb6
push 8
jmp 0x18030ae6
push 0xc
jmp 0x18030ae6
push 0xa
jmp 0x18030ae6
sub eax, 0x66
je 0x18030be6
sub eax, 8
je 0x18030bdb
sub eax, 6
je 0x18030bd0
sub eax, 7
je 0x18030bc9
dec eax
sub eax, 1
je 0x18030bc2
mov dword [esi + 0x40], str.invalid_literal
jmp 0x18030ae4
push 0xb
jmp 0x18030ae6
push 9
jmp 0x18030ae6
push 1
push 4
push str.true
jmp 0x18030bef
push 3
push 4
push str.null
jmp 0x18030bef
push 2
push 5
push str.false
mov ecx, esi
call fcn.18030d8c
pop esi
ret
Function at 0x1803b579
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x181ce00c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
push 0x400
lea eax, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edi
push eax
mov dword [esp + 0x1c], edi
call fcn.1812f700
add esp, 0xc
mov dword [esp + 0x18], edi
push 0x60
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1803b5f0
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1803b5f0
call fcn.180079f0
mov esi, eax
jmp 0x1803b6a3
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1803b60c
call fcn.180079f0
jmp 0x1803b696
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1803b602
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x1803b632
mov esi, 0x8007000e
jmp 0x1803b698
push 2
pop edx
lfence
call fcn.18010467
cmp eax, 0x400
jbe 0x1803b653
push eax
lea ecx, [esp + 0x1c]
lfence
call fcn.18041883
jmp 0x1803b65b
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x1803b62b
push esi
lfence
push dword [esp + 0x1c]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1803b602
mov eax, dword [esp + 0x18]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [esp + 0x14]
push dword [esp + 0x1c]
call fcn.1803c158
mov esi, eax
test edi, edi
je 0x1803b6a3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x1c]
cmp dword [esp + 0x18], eax
je 0x1803b6b6
lea ecx, [esp + 0x18]
call fcn.180409b7
mov ecx, dword [esp + 0x424]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1811aa48
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1803d4fe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 0x98]
cmp dword [esi], 0
jne 0x1803d559
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [esi + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
inc edi
test eax, eax
je 0x1803d555
jmp 0x1803d54f
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
cmp eax, ebx
jae 0x1803d546
or ecx, 0xffffffff
sub ecx, ebx
add ecx, eax
cmp ecx, dword [ebp - 4]
jae 0x1803d555
cmp dword [esi + 4], 0
jg 0x1803d52a
xchg dword [esi], edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1803dd9a
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 2
pop esi
mov ecx, dword [edi + 0x80]
cmp ecx, dword [edi + 0x84]
je 0x1803ddcd
xor eax, eax
cmp dword [ecx + 0x14], eax
setne al
mov dword [ebp - 0xc], eax
mov esi, eax
mov al, byte [edi + 0x8d]
mov bl, byte [edi + 0x11]
mov dword [ebp - 0xc], eax
call fcn.1801fada
mov ecx, dword [edi + 0xc]
inc eax
push esi
push ebx
push dword [ebp - 0xc]
mov dl, byte [eax]
call fcn.1803f4b2
add esp, 0xc
mov byte [edi + 0x8c], al
mov ecx, 0x181cf618
push eax
call fcn.1802618c
cmp byte [edi + 0x8c], 0
je 0x1803de1a
call fcn.180170f1
test al, al
je 0x1803de1a
mov cl, 1
xor ebx, ebx
jmp 0x1803de1e
xor ebx, ebx
mov cl, bl
call fcn.18074abe
mov edx, dword [edi]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18014e07
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], ebx
je 0x1803defc
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1803defc
movzx ecx, byte [0x181d4056]
neg ecx
sbb ecx, ecx
and ecx, 0x181d3f50
je 0x1803dea8
push 7
pop edx
push 3
pop eax
push eax
push edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008b3f
mov edx, esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.1800722f
push dword [ebp - 0xc]
movzx eax, byte [edi + 0x8c]
push eax
lea eax, [ebp - 0x1c]
push str._is_machine:__d__Current_dir___s_
push eax
call fcn.18007210
mov ecx, dword [ebp - 0xc]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, edi
call fcn.1803e75a
mov cl, byte [edi + 0x8c]
call fcn.1803f38a
push dword [edi + 0xc]
call fcn.1803e676
test al, al
je 0x1803dedc
mov cl, byte [edi + 0x8c]
call fcn.18027221
test al, al
je 0x1803dedc
mov edi, 0xa0430607
jmp 0x1803df03
lea eax, [ebp - 8]
mov ecx, edi
push eax
push dword [edi + 0xc]
call fcn.1803e6c8
mov edi, eax
mov ecx, edi
call fcn.1801d137
mov esi, dword [ebp - 8]
test edi, edi
js 0x1803df03
jmp 0x1803df05
call fcn.1801bb25
mov edi, eax
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x1803efb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call fcn.1801fada
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdate_
jne 0x1803efe4
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdate_
push eax
lea ecx, [ebp - 8]
call fcn.180074da
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x18]
and dword [ebp - 0x14], 0
push 0x20019
push edi
mov dword [ebp - 0x18], 0x1819c04c
mov dword [ebp - 0x10], 0x200
call fcn.1801a30e
mov ebx, eax
mov ecx, ebx
call fcn.1801d137
test ebx, ebx
js 0x1803f159
lea ecx, [ebp - 0x18]
call fcn.1801b2de
test eax, eax
je 0x1803f154
push str.Clients
lea ecx, [ebp - 0x18]
call fcn.1801a370
test al, al
je 0x1803f154
push str.ClientState
lea ecx, [ebp - 0x18]
call fcn.1801a370
test al, al
je 0x1803f154
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.version
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803f154
push ebx
push ebx
push ebx
push ebx
push str.path
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1803f154
mov dword [ebp - 8], ebx
call fcn.18006f7b
push eax
lea ecx, [ebp - 8]
call fcn.1800768f
lea eax, [ebp - 8]
push eax
push str.version
lea ecx, [ebp - 0x18]
call fcn.1801a8f3
mov ebx, eax
mov ecx, ebx
call fcn.1801d137
test ebx, ebx
js 0x1803f147
and dword [ebp - 0x1c], 0
call fcn.1801fada
cmp byte [esi + 0x8c], 0
mov eax, str.HKLMSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
jne 0x1803f0e0
mov eax, str.HKCUSoftwareMicrosoftEdgeUpdateClientsF3C4FE00_EFD5_403B_9569_398A20F1BA4A
push eax
lea ecx, [ebp - 0x1c]
call fcn.180074da
and dword [ebp - 0xc], 0
call fcn.18006f7b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800768f
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
mov edx, 0x181a5cb8
mov ecx, esi
call fcn.1801cb41
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.1801d137
test ebx, ebx
js 0x1803f134
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.18009bef
test al, al
je 0x1803f132
mov ebx, 0xa043090b
jmp 0x1803f134
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18006f52
lea ecx, [esi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
jmp 0x1803f159
mov ebx, 0x80070003
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x1819c04c
je 0x1803f17a
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x200
lea ecx, [edi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x1803fe9a
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18156500
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015d41
test al, al
je 0x1804008b
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812f700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18040ac0
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x1803ff21
mov ecx, edi
call fcn.1801d137
test edi, edi
jns 0x1804008b
mov ecx, edi
call fcn.1801d137
test edi, edi
jns 0x1803ff33
mov eax, edi
jmp 0x1804008d
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x1803ff58
call fcn.1801bb25
mov esi, eax
jmp 0x18040087
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18081c3c
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1803ff8e
call fcn.1801bb25
mov esi, eax
jmp 0x18040072
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18042616
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x18040001
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x1803ffc0
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a9a80
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18040055
call fcn.1801bb25
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18040060
push esi
call fcn.1811b2f3
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1804008d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1811aa48
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x180400a0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015d41
test al, al
je 0x18040144
call fcn.18040b9c
test al, al
jne 0x18040144
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180400e7
call fcn.1801bb25
mov ebx, eax
jmp 0x18040140
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081c3c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1804011c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18040127
call fcn.1801bb25
mov ebx, eax
test esi, esi
je 0x1804012e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18040146
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x1804036b
Capabilities:
Modify service

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2038
call fcn.18156500
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.18015d41
test al, al
je 0x1804055c
push 0x2000
xor esi, esi
lea eax, [ebp - 0x2008]
push esi
push eax
mov dword [ebp - 0x201c], esi
call fcn.1812f700
add esp, 0xc
mov dword [ebp - 0x200c], esi
lea eax, [ebp - 0x200c]
lea ecx, [ebp - 0x2008]
push eax
call fcn.18040f29
mov edi, dword [ebp - 0x200c]
pop ecx
test al, al
je 0x180403f2
mov ecx, edi
call fcn.1801d137
test edi, edi
jns 0x1804055c
mov ecx, edi
call fcn.1801d137
test edi, edi
jns 0x18040404
mov eax, edi
jmp 0x1804055e
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x18040429
call fcn.1801bb25
mov esi, eax
jmp 0x18040558
lea ecx, [ebp - 0x200c]
mov dword [ebp - 0x200c], esi
call fcn.18081b7f
push 2
push dword [ebp - 0x200c]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
test eax, eax
jne 0x1804045f
call fcn.1801bb25
mov esi, eax
jmp 0x18040543
mov edx, dword [ebp - 0x2008]
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
lea edx, [edx + 1]
call fcn.18042616
mov ecx, dword [ebp - 0x2008]
mov dword [ebp - 0x2014], esi
test ecx, ecx
je 0x180404d2
mov eax, dword [ebp - 0x2010]
mov edx, esi
mov esi, dword [ebp - 0x2004]
lea edi, [ebp - 0x2038]
add esi, edx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
lea edi, [edx + eax]
add edx, 0x14
pop ecx
lea esi, [ebp - 0x2038]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2014]
mov ecx, dword [ebp - 0x2008]
inc esi
mov dword [ebp - 0x2014], esi
cmp esi, ecx
jb 0x18040491
mov edi, dword [ebp - 0x2020]
mov esi, dword [ebp - 0x2010]
imul eax, ecx, 0x14
xor ecx, ecx
add eax, esi
mov dword [eax], 0x14
mov dword [eax + 4], 1
mov dword [eax + 8], 0x181a9a80
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x2008]
inc dword [ebp - 0x2008]
push eax
push 8
push dword [ebp - 0x2018]
mov dword [ebp - 0x2004], esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x18040526
call fcn.1801bb25
mov dword [ebp - 0x201c], eax
test esi, esi
je 0x18040531
push esi
call fcn.1811b2f3
pop ecx
push dword [ebp - 0x2018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x200c]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1804055e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1811aa48
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x18040571
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.18015d41
test al, al
je 0x18040615
call fcn.18041005
test al, al
jne 0x18040615
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x180405b8
call fcn.1801bb25
mov ebx, eax
jmp 0x18040611
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081b7f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x180405ed
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x180405f8
call fcn.1801bb25
mov ebx, eax
test esi, esi
je 0x180405ff
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
jmp 0x18040617
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret

Function at 0x18040c74
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18041934
test al, al
je 0x18040c9c
xor eax, eax
jmp 0x18040d4f
call fcn.180401eb
mov esi, eax
mov ecx, esi
call fcn.1801d137
test esi, esi
jns 0x18040cb8
lfence
mov eax, esi
jmp 0x18040d4f
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x18040ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040d4d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18040d4d
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081c3c
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18040d1b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 3
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x18040d34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18040d30
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x18040d3b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret
Function at 0x180410dd
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0xc], eax
call fcn.18041ae2
test al, al
je 0x18041105
xor eax, eax
jmp 0x180411b8
call fcn.180406bc
mov esi, eax
mov ecx, esi
call fcn.1801d137
test esi, esi
jns 0x18041121
lfence
mov eax, esi
jmp 0x180411b8
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1804114d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x180411b6
movzx ebx, bx
or ebx, 0x80070000
jmp 0x180411b6
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081b7f
push 2
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x18041184
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1804119d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18041199
movzx ebx, bx
or ebx, 0x80070000
test esi, esi
je 0x180411a4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret

Function at 0x180411c7
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181ce00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov edi, ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x1804120c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18041281
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18041281
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.18081b7f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.18041a56
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
push edi
mov edi, dword [ebp - 0xc]
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x18041260
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x18041267
movzx ebx, bx
or ebx, 0x80070000
jmp 0x18041267
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [edi - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18006f52
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811aa48
leave
ret