joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fe0
Capabilities:
Create directory

Disassembly:
sub esp, 0x24c
push ebx
mov ebx, dword [esp + 0x254]
test ebx, ebx
mov dword [esp + 4], 0
je 0x40a1cc
cmp byte [ebx], 0
je 0x40a1cc
mov ecx, dword [esp + 0x258]
test ecx, ecx
je 0x40a030
mov eax, dword [ecx]
test eax, eax
jle 0x40a023
cmp eax, 4
jge 0x40a023
test byte [ecx + 4], 7
jne 0x40a030
mov eax, 0x80000066
pop ebx
add esp, 0x24c
ret
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0
push ebx
call fcn.00409e90
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a1b8
mov ecx, dword [esp + 0x10]
push 1
lea edi, [ecx + 2]
push edi
call fcn.00431053
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x40a07d
mov esi, 0x80000078
jmp 0x40a1ab
lea edx, [esp + 0x10]
push edx
push ebp
push ebx
call fcn.00409e90
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a1ab
mov eax, dword [esp + 0x10]
cmp byte [eax + ebp - 2], 0x5c
je 0x40a0b0
push edi
push 0x43d4b0
push ebp
call fcn.00409a40
add esp, 0xc
push 0x43d4b0
push ebp
call fcn.00431b5d
add esp, 8
test eax, eax
je 0x40a1a9
push 0x105
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004099d0
push 0x105
lea edx, [esp + 0x24]
push 0x43d4b0
push edx
call fcn.00409a40
push 0x43d4b0
push 0
call fcn.00431b5d
add esp, 0x20
test eax, eax
je 0x40a1a9
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x105
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00409a40
add esp, 0xc
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
cmp eax, 0xffffffff
jne 0x40a177
lea eax, [esp + 0x14]
push 0
push eax
call ebx
test eax, eax
jne 0x40a150
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40a1c5
jmp 0x40a17e
mov eax, dword [esp + 0x264]
test eax, eax
je 0x40a17e
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0040a1e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40a1ab
jmp 0x40a17e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x105
lea ecx, [esp + 0x18]
push 0x43d4b0
push ecx
call fcn.00409a40
push 0x43d4b0
push 0
call fcn.00431b5d
add esp, 0x14
test eax, eax
jne 0x40a10d
xor esi, esi
test ebp, ebp
je 0x40a1b8
push ebp
call fcn.00430c60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
mov esi, 0x800000de
jmp 0x40a1ab
mov eax, 0x80000065
pop ebx
add esp, 0x24c
ret
Function at 0x40a1e0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x44]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
je 0x40a3e9
cmp byte [eax], bl
je 0x40a3e9
mov esi, dword [esp + 0x54]
cmp esi, ebx
jle 0x40a2c0
cmp esi, 4
jge 0x40a2c0
test byte [esp + 0x58], 7
jne 0x40a22c
pop edi
pop esi
mov eax, 0x80000067
pop ebx
add esp, 0x40
ret
lea eax, [esp + 0x14]
mov edx, 3
test eax, eax
mov dword [esp + 0x1c], 1
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], dl
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 2
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], dl
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], edx
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 1
mov dword [esp + 0x48], ebx
je 0x40a302
lea ecx, [esp + 0x58]
test ecx, ecx
je 0x40a302
xor eax, eax
lea ecx, [esp + 0x1c]
cmp esi, dword [ecx]
je 0x40a2cc
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x40a2b4
pop edi
pop esi
mov eax, 0x80000066
pop ebx
add esp, 0x40
ret
shl eax, 4
lea edx, [esp + eax + 0x20]
mov eax, dword [esp + eax + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x58]
mov dx, word [edx + 4]
dec ecx
cmp ecx, 6
mov word [esp + 0x18], dx
ja case.0x40a2f4.3
jmp dword [ecx*4 + 0x40a3f8]
mov esi, 0x80000000
jmp 0x40a321
pop edi
pop esi
mov eax, 0x8000009b
pop ebx
add esp, 0x40
ret
mov esi, 0x40000000
jmp 0x40a321
mov esi, 0x20000000
jmp 0x40a321
mov esi, 0x10000000
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [esp + 0x38]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40a346
mov esi, 0x800000db
jmp 0x40a3c2
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push ebx
push eax
push 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], ecx
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
je 0x40a395
mov esi, 0x800000db
jmp 0x40a3c2
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x50]
push ebx
push ecx
push ebx
push ebx
push 4
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
cmp eax, ebx
jne 0x40a3b4
xor esi, esi
jmp 0x40a3c2
sub eax, 5
neg eax
sbb eax, eax
and eax, 0x800000db
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x40a3d1
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a3e0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x40
ret
pop edi
pop esi
mov eax, 0x80000065
pop ebx
add esp, 0x40
ret
Function at 0x40a780
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x2b8
push ebx
push esi
mov esi, dword [esp + 0x2c4]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0xc], 1
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], 5
mov dword [esp + 0x18], ebx
jne 0x40a7ca
pop edi
pop esi
mov eax, 0x80000065
pop ebx
add esp, 0x2b8
ret
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 2
je 0x40a7ff
mov dword [esi], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2b8
ret
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x40a8bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.AllocateAndInitializeSid
push ebx
call esi
push str.CheckTokenMembership
push ebx
mov edi, eax
call esi
push str.FreeSid
push ebx
mov ebp, eax
call esi
cmp edi, ebx
mov esi, eax
je 0x40a898
cmp ebp, ebx
je 0x40a898
cmp esi, ebx
je 0x40a898
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push edx
call edi
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x40a898
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push ecx
push ebx
call ebp
test eax, eax
je 0x40a88f
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp eax, ebx
mov eax, dword [esp + 0x2cc]
setne dl
mov dword [eax], edx
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x20]
push ecx
call esi
jmp 0x40a8a0
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jne 0x40a93c
mov esi, dword [esp + 0x2c8]
lea edx, [esp + 0x1bc]
push 0x105
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.slmdummytestfile.tmp
lea eax, [esp + 0x1c0]
push 0x43d4b0
push eax
push str._s_s_s
lea ecx, [esp + 0xc4]
push 0x105
push ecx
call fcn.00409b70
lea edx, [esp + 0xcc]
push 0x43d4b4
push edx
call fcn.004313a4
add esp, 0x20
cmp eax, ebx
jne 0x40a91f
mov dword [esi], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2b8
ret
push eax
mov dword [esi], 1
call fcn.00430e41
add esp, 4
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2b8
ret

Function at 0x411b40
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x411b85
mov ecx, dword [esp]
push 0x444f54
push 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, dword [esp]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [0x444f68], 1
xor eax, eax
pop ecx
ret
Function at 0x412b50
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x10
test ecx, ecx
je 0x412c4e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x412c4e
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
jmp 0x412b79
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
lea eax, [edi + ecx]
sub esi, ecx
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x412b8d
inc ebp
cmp ebp, 4
jl 0x412b75
cmp edi, 0xb0
jge 0x412c44
mov ebp, 0x441e88
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, 0x80000003
jns 0x412bc8
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + str.cw]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x412bb8
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x412c02
inc esi
cmp esi, 4
jl 0x412bf9
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x412c22
inc esi
cmp esi, 4
jl 0x412c19
cmp edi, 0xb0
jl 0x412bb2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, 1
add esp, 0x10
ret
Function at 0x413aa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x413b8b
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x413b8b
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x413b80
mov ecx, eax
and ecx, 0x8000000f
jns 0x413ad8
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x413b80
cmp eax, 0x10
jl 0x413b78
push ebp
push edi
shr eax, 4
lea edi, [esi + 0xb0]
mov dword [esp + 0x28], eax
jmp 0x413afc
mov esi, dword [esp + 0x24]
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
xor eax, eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x1c], ecx
mov dl, byte [edi + eax]
mov cl, byte [esp + eax + 0x10]
xor cl, dl
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x10
jl 0x413b1b
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00412c60
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebp, edi
mov esi, dword [esp + 0x24]
add esp, 8
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], esi
mov ebp, ebx
add ebx, 0x10
mov dword [ebp], eax
mov eax, dword [esp + 0x28]
dec eax
mov dword [ebp + 4], ecx
mov dword [esp + 0x28], eax
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], esi
jne 0x413af8
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
pop esi
mov eax, 2
pop ebx
add esp, 0x10
ret
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x413ba0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
push edi
je 0x413c86
mov edi, dword [esp + 0x20]
test edi, edi
je 0x413c86
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x413c7b
mov ecx, eax
and ecx, 0x8000000f
jns 0x413bd8
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x413c7b
cmp eax, 0x10
jl 0x413c73
push ebx
push esi
shr eax, 4
lea esi, [ebp + 0xb0]
mov ebx, eax
mov edx, edi
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x14], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [edx + 0xc]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x24], ecx
call fcn.004132d0
add esp, 8
xor eax, eax
mov cl, byte [esi + eax]
mov dl, byte [esp + eax + 0x10]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x10
jl 0x413c21
mov edx, edi
mov eax, esi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x14]
mov eax, edi
add edi, 0x10
dec ebx
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jne 0x413bf4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x10
ret
pop edi
mov eax, 2
pop ebp
add esp, 0x10
ret
pop edi
mov eax, 1
pop ebp
add esp, 0x10
ret
Function at 0x413ca0
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
cmp edx, esi
jne 0x413cb2
mov eax, 0x80000065
pop esi
ret
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [edx + 0x14]
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov dword [edx + 0x54], esi
mov dword [edx + 0x58], esi
rep stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x415ed0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x415ee0
mov eax, 1
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x24], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
xor eax, eax
ret
Function at 0x41b370
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x114
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
test ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
je 0x41b503
cmp byte [ebp], 0
je 0x41b503
mov esi, dword [esp + 0x128]
test esi, esi
je 0x41b4f4
cmp byte [esi], 0
je 0x41b4f4
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0
push esi
call fcn.00409e90
add esp, 0xc
test eax, eax
jne 0x41b4bd
mov ecx, dword [esp + 0x10]
push 1
push ecx
call fcn.00431053
mov edi, eax
add esp, 8
test edi, edi
jne 0x41b3ff
mov esi, 0x80000078
jmp 0x41b4ae
lea edx, [esp + 0x10]
push edx
push edi
push esi
call fcn.00409e90
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41b4ae
push ebp
push str.SystemCurrentControlSetServicesEventLogApplication
push str._s_s
lea eax, [esp + 0x24]
push 0x105
push eax
call fcn.00409b70
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push 0xf003f
push esi
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41b47e
lea eax, [esp + 0xc]
push esi
push eax
push esi
push 0xf003f
push esi
push esi
lea ecx, [esp + 0x30]
push esi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x41b47e
mov esi, 0x800009f1
jmp 0x41b4ae
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edx
push edi
push 2
push 0
push str.EventMessageFile
push eax
call esi
test eax, eax
je 0x41b4c7
mov esi, 0x800009f2
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x41b4bb
push edi
call fcn.00430c60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x114
ret
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push str.TypesSupported
push edx
mov dword [esp + 0x2c], 7
call esi
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x800009f2
jmp 0x41b4a3
pop edi
pop esi
mov eax, 0x80000066
pop ebp
add esp, 0x114
ret
pop edi
pop esi
mov eax, 0x80000065
pop ebp
add esp, 0x114
ret
Function at 0x41b580
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [0x445250]
push ebx
push esi
push edi
xor edi, edi
mov ebx, 1
test eax, eax
jne 0x41b59c
pop edi
pop esi
mov eax, 0x800009f3
pop ebx
ret
mov esi, dword [esp + 0x14]
test esi, esi
jbe 0x41b5d8
push 4
push esi
call fcn.00431053
mov edi, eax
add esp, 8
test edi, edi
jne 0x41b5bc
mov esi, 0x80000078
jmp 0x41b62e
test esi, esi
jbe 0x41b5d8
push ebp
lea eax, [esp + 0x18]
mov ecx, edi
mov edx, esi
mov ebp, dword [eax + 4]
add eax, 4
mov dword [ecx], ebp
add ecx, 4
dec edx
jne 0x41b5c9
pop ebp
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x1e
cmp eax, 3
ja case.default.0x41b5e6
jmp dword [eax*4 + 0x41b644]
xor ebx, ebx
jmp case.default.0x41b5e6
mov ebx, 4
jmp case.default.0x41b5e6
mov ebx, 2
jmp case.default.0x41b5e6
mov ebx, 1
mov eax, dword [0x445250]
push 0
push edi
push 0
push esi
push 0
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7ffff611
add esi, 0x800009ef
test edi, edi
je 0x41b63b
push edi
call fcn.00430c60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x41b9b0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
test ebx, ebx
rep stosd dword es:[edi], eax
jne 0x41b9e9
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0x124]
test eax, eax
jne 0x41ba04
pop edi
pop esi
pop ebp
mov eax, 0x80000066
pop ebx
add esp, 0x10c
ret
mov edx, dword [esp + 0x128]
test edx, edx
jne 0x41ba1f
pop edi
pop esi
pop ebp
mov eax, 0x80000067
pop ebx
add esp, 0x10c
ret
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
push 2
rep stosd dword es:[edi], eax
push 0
push 0
stosb byte es:[edi], al
mov dword [esp + 0x1c], edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x41bafc
lea eax, [esp + 0x14]
push 0x105
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x41bac8
push 0
push 0
mov edx, dword [esp + 0x12c]
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
push 0
push 2
push 0x10
push 0xf01ff
push ebx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
je 0x41bac8
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x41babf
call fcn.0041bfe0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call edi
push esi
call edi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10c
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x41bacf
call fcn.0041bfe0
mov ebp, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jne 0x41baef
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0041b370
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
call fcn.0041bfe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x41bb10
Capabilities:
Delete service
Query service status

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x34]
mov dword [esp + 0x30], ebp
cmp ebx, ebp
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], ebp
jne 0x41bb52
pop edi
pop esi
pop ebp
mov eax, 0x80000065
pop ebx
add esp, 0x44
ret
push 1
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
je 0x41bc0c
push 0x10004
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebp
je 0x41bbf4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
push 0x24
push ecx
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x41bbae
call fcn.0041bfe0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x44
ret
cmp dword [esp + 0x34], 1
je 0x41bbc0
push ebx
call fcn.0041be30
add esp, 4
mov ebp, eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41bb91
cmp dword [esp + 0x18], 1
jne 0x41bbde
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call fcn.0041bfe0
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call fcn.0041bfe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x41bc20
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x3c]
push edi
xor ebx, ebx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], ebx
cmp esi, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
jne 0x41bc55
pop edi
pop esi
mov eax, 0x80000065
pop ebx
add esp, 0x30
ret
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x18]
push 0xf003f
push ebx
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x14], edi
jne 0x41bc85
call fcn.0041bfe0
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebx
jne 0x41bcaf
call fcn.0041bfe0
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
lea eax, [esp + 0x10]
push ebp
push eax
lea ecx, [esp + 0x20]
push 0x24
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push esi
call ebx
test eax, eax
je 0x41be06
mov eax, dword [esp + 0x20]
mov ebp, 3
cmp eax, 1
je 0x41bce4
cmp eax, ebp
jne 0x41be06
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x41bd5a
mov ecx, dword [esp + 0x34]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
cmp edx, 0x3e8
jae 0x41bd11
mov edx, 0x3e8
jmp 0x41bd1e
cmp edx, 0x2710
jbe 0x41bd1e
mov edx, 0x2710
push edx
call fcn.0040aab0
add esp, 4
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push 0x24
push eax
push 0
push esi
call ebx
test eax, eax
je 0x41be06
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x34]
sub eax, edi
cmp eax, ecx
ja 0x41be0f
cmp dword [esp + 0x20], ebp
je 0x41bcf8
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x41be06
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0x24
push edx
push 0
push esi
call ebx
test eax, eax
jne 0x41bd96
call fcn.0041bfe0
mov eax, dword [esp + 0x44]
push eax
call fcn.0041be30
add esp, 4
jmp 0x41be0b
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov edi, eax
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x41be0f
mov ecx, dword [esp + 0x34]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
cmp edx, 0x3e8
jae 0x41bdc6
mov edx, 0x3e8
jmp 0x41bdd3
cmp edx, 0x2710
jbe 0x41bdd3
mov edx, 0x2710
push edx
call fcn.0040aab0
add esp, 4
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0x24
push edx
push 0
push esi
call ebx
test eax, eax
je 0x41be06
call ebp
mov ecx, dword [esp + 0x34]
sub eax, edi
cmp eax, ecx
ja 0x41be0f
cmp dword [esp + 0x20], 2
je 0x41bdad
jmp 0x41be0f
call fcn.0041bfe0
mov dword [esp + 0x10], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x30
ret