joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp + 8]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x1000
push edx
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x401644
cmp eax, 0x3e5
je 0x401644
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401684
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401662
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0
jmp 0x40168b
push 1
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40168b
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x401696
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4026b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x206
mov dword [ebp - 0xc], 1
test edi, edi
je 0x402716
test esi, esi
je 0x402716
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402716
lea ecx, [ebp - 4]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402716
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [esi + eax*2], 0
je 0x40271c
xor ecx, ecx
mov word [esi + eax*2], cx
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x402730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
test esi, esi
je 0x40278b
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40278b
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.JHI_LOG
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402791
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4027b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402809
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_SERVICE_PORT
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4027ff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret

Function at 0x402820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402879
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push str.JHI_ADDRESS_TYPE
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40286f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret
Function at 0x40afe0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a860
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x423018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
sub esp, 8
mov eax, esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], esp
mov dword [eax], 0
mov dword [eax + 4], 0
push eax
lea eax, [ebp + 0x10]
call fcn.0040b9b0
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0040adb0
lea edi, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
push 0x202
mov dword [esi], vtable.intel_dal::CommandsServerSocketsWin32.0
mov dword [esi + 0x1a8], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40b082
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], str.WSAStartup_failed
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x41f29c
lea edx, [ebp - 0x1c]
push edx
call sub.MSVCR100.dll__CxxThrowException
cmp byte [edi], 2
jne 0x40b0b1
cmp byte [edi + 1], 2
jne 0x40b0b1
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.0040b970
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], str.Could_not_find_a_usable_version_of_Winsock.dll
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x41f29c
lea ecx, [ebp - 0x1c]
push ecx
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x40b460
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test edi, edi
je 0x40b49a
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp + 0xc]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
lea edx, [esi + ecx]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x40b494
test eax, eax
je 0x40b494
add esi, eax
cmp esi, edi
jne 0x40b471
pop ebx
mov eax, esi
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret

Function at 0x40b4a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
test edi, edi
je 0x40b4d6
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp + 0xc]
push 0
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp + 8]
lea edx, [esi + ecx]
push edx
push eax
call ebx
cmp eax, 0xffffffff
je 0x40b4d0
add esi, eax
cmp esi, edi
jne 0x40b4b1
pop ebx
mov eax, esi
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40b7d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a558
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x14
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x40b81f
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov edi, eax
jmp 0x40b821
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
add eax, 0x10
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040b9b0
mov esi, dword [edi + 8]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [edi + 8], eax
mov dword [edi + 4], edx
cmp esi, ebx
je 0x40b87e
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b87e
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b87e
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x20]
call fcn.0040aed0
lea esi, [ebp - 0x18]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], 2
cmp esi, eax
je 0x40b8a6
mov ecx, dword [eax + 4]
mov dword [eax + 4], ebx
mov edx, dword [eax]
mov dword [eax], ebx
mov esi, dword [edi + 0x10]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], edx
cmp esi, ebx
je 0x40b8dc
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b8dc
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b8dc
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x40b913
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40b913
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40b913
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
push ebx
push ebx
push edi
push 0x40b4e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40b92e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x40d5ef
mov eax, dword [ebp - 4]
push 0
and eax, 0xffff02ff
lea ecx, [ebp - 8]
push ecx
or eax, 0x2ff
push 4
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov edx, esi
call fcn.0040d630
test al, al
setne al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40d630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a220
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, edx
xor ecx, ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], ecx
cmp ebx, ecx
je 0x40d6e1
mov eax, dword [edi + 0x10]
cmp eax, ecx
je 0x40d6e1
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
mov eax, dword [edi + 0x10]
add esp, 4
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
mov eax, dword [edi + 0x10]
mov edi, dword [edi + 0xc]
add esp, 0xc
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d6d3
cmp byte [esi + 3], 0
jne 0x40d6d3
movzx edx, word [esi + 6]
mov word [ebx], dx
mov ax, word [esi + 4]
mov word [ebx + 2], ax
mov cx, word [esi + 0xa]
mov word [ebx + 4], cx
movzx edx, word [esi + 8]
mov word [ebx + 6], dx
mov byte [ebp - 0x11], 1
test esi, esi
je 0x40d6e1
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e260
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41befe
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x423018]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
test byte [0x423c0c], 1
jne 0x40e2c9
or dword [0x423c0c], 1
mov dword [esp + 0x70], 0
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [esp + 0x70], 0xffffffff
cmp byte [0x423c14], 0
je 0x40e2d9
xor eax, eax
jmp 0x40e45f
call fcn.00416d90
test al, al
jne 0x40e320
push 0x41dee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40e316
push 0
push 0
push 0
push 0
push 0
push 0xc0000005
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, 0x300
jmp 0x40e45f
call fcn.0040de10
test eax, eax
jne 0x40e45f
call fcn.00403e60
cmp byte [eax + 5], 0
je 0x40e356
push 0x1010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
lea esi, [esp + 0x48]
call fcn.0040e200
test al, al
jne 0x40e37c
push 0xc0000005
push 1
call fcn.0040c740
add esp, 8
mov eax, 0x300
jmp 0x40e45f
call fcn.00403e60
mov esi, eax
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x18
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esi + 0x74]
push 0x18
push edx
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov eax, dword [esi]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edi, [esp + 0x48]
lea esi, [esp + 0x14]
call fcn.00414f60
mov edi, eax
test edi, edi
jne 0x40e433
call fcn.00403e60
mov ebx, eax
mov ecx, dword [ebx]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebx]
lea edi, [ebx + 0x40]
mov ecx, 0xd
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x44]
push eax
call dword [esp + 0x18]
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e433
call fcn.004090e0
mov edi, eax
call fcn.00402a20
test al, al
jne 0x40e40e
mov edi, 0x601
jmp 0x40e433
call fcn.0040ac30
mov ecx, eax
call fcn.0040cb40
mov edi, eax
test edi, edi
jne 0x40e433
call fcn.0040fba0
push 1
call fcn.00403e60
mov esi, eax
call fcn.0040dde0
call fcn.00403e60
cmp byte [eax + 5], 0
je 0x40e45d
push edi
push 0x1011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, edi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00419346
mov esp, ebp
pop ebp
ret
Function at 0x40f3d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x423018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40f4b4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x40f4b4
push 0xffffffffffffffff
push 0x41df4c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f4b4
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f460
sub eax, edx
sar eax, 1
push edi
lea edi, [eax + 1]
lea edx, [edi + edi]
push edx
call fcn.00401700
mov esi, eax
add esp, 4
test esi, esi
je 0x40f4c5
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
call dword [sym.imp.MSVCR100.dll_wcscpy_s]
add esp, 0xc
test eax, eax
mov eax, esi
je 0x40f4c7
call fcn.00401770
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419346
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419346
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00419346
mov esp, ebp
pop ebp
ret

Function at 0x410080
Capabilities:
Access the windows event log
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x410070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x41dee4
push 0
mov dword [0x423d00], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4100cf
push 0
push 0
push 0
push 0
push 0
push 0x40000000
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret
Function at 0x4100e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bc4e
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x423018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.closing_command_server_n
call dword [sym.imp.MSVCR100.dll_printf]
mov ecx, dword [0x425dec]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
add esp, 4
call edx
mov eax, dword [0x423d00]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x423d00], 0
test byte [0x423c0c], al
jne 0x410167
or dword [0x423c0c], eax
mov dword [ebp - 4], 0
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [0x423c14], 0
je 0x410175
call fcn.0040e480
push 0x41dee4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4101a9
push 0
push 0
push 0
push 0
push 0
push 0x40000001
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4164c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bd7a
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x423018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x423c0c], 1
mov esi, ecx
jne 0x41651d
or dword [0x423c0c], 1
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x41651f
xor ebx, ebx
cmp byte [0x423c15], 0
je 0x416546
push 0x4010
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_n
call fcn.00401000
add esp, 0x10
mov ecx, esi
call fcn.004160b0
mov edi, eax
mov dword [ebp - 0x4c], edi
cmp edi, ebx
je 0x416562
cmp edi, 0x402
jne 0x416642
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 1
mov byte [ebp - 0x48], al
mov eax, esi
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
lea edx, [eax + 1]
jmp 0x416590
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416590
sub eax, edx
mov edi, eax
mov eax, esi
lea esi, [ebp - 0x48]
call fcn.00401fb0
mov bl, 2
mov byte [ebp - 4], bl
test byte [0x423cb0], 1
jne 0x4165d3
or dword [0x423cb0], 1
mov byte [ebp - 4], 3
call fcn.00402990
push 0x41c690
call fcn.0041946d
add esp, 4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403620
cmp dword [ebp - 0x34], 0x10
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov bl, al
jb 0x4165f6
mov edx, dword [ebp - 0x48]
push edx
call edi
add esp, 4
mov esi, 8
test bl, bl
je 0x41662a
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x41660a
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416623
cmp dword [ebp - 0x4c], eax
jne 0x41662a
mov dword [ebp - 0x4c], 0x104
jmp 0x41662a
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], esi
jb 0x41663f
mov eax, dword [ebp - 0x2c]
push eax
call edi
add esp, 4
mov edi, dword [ebp - 0x4c]
test byte [0x423c0c], 1
jne 0x41666b
or dword [0x423c0c], 1
mov dword [ebp - 4], 4
call fcn.0040db20
push 0x41c620
call fcn.0041946d
add esp, 4
cmp byte [0x423c15], 0
je 0x416693
push edi
push 0x4011
push str.JHISVC
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d____s__FN:__08x_RET:_0x_08x_n
call fcn.00401000
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419346
mov esp, ebp
pop ebp
ret
Function at 0x4169b0
Capabilities:
Delete service

Disassembly:
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4169fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4169e6
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, 2
pop esi
ret
push eax
push str.OpenSCManager_failed___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, 1
pop esi
ret
push edi
push 0x10000
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416a43
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x416a67
cmp eax, 0x424
jne 0x416a7d
push str.Error:_the_service_does_not_exist._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
ret
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x416a96
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x416a7d
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
pop edi
mov eax, 2
pop esi
ret
call esi
push eax
push str.Uninstall_Service_failed:___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
pop edi
mov eax, 1
pop esi
ret
push str.JHI_Service_removed_successfully_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
ret
Function at 0x416ac0
Capabilities:
Start service

Disassembly:
push esi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x416b09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x416af3
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, 2
pop esi
ret
push eax
push str.OpenSCManager_failed___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
mov eax, 1
pop esi
ret
push edi
push 0x20000000
push str.jhi_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x416b50
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
je 0x416b78
cmp eax, 0x424
jne 0x416bab
push str.Error:_the_service_does_not_exist._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
lea eax, [edi + 4]
pop edi
pop esi
ret
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x416bc4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x416b8e
push str.ACCESS_DENIED:_administrative_privileges_required._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
pop edi
mov eax, 2
pop esi
ret
cmp eax, 0x420
jne 0x416bab
push str.Error:_JHI_service_already_running._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
pop edi
mov eax, 5
pop esi
ret
call esi
push eax
push str.Start_Service_failed:___d__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
pop edi
mov eax, 1
pop esi
ret
push str.JHI_Service_started_successfully_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
pop esi
ret