joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410600
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x211c
call fcn.0046b3f0
push edi
mov dword [ebp - 0x211c], 0
mov al, byte [0x491b47]
mov byte [ebp - 0x2118], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x2117]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2118]
push ecx
call fcn.00404180
add esp, 4
mov dl, byte [0x491b47]
mov byte [ebp - 0x2010], dl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x200f]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2010]
push ecx
call fcn.0046b260
add esp, 8
push 0x491b44
push 0x491b40
lea edx, [ebp - 0x2010]
push edx
call fcn.0040e170
add esp, 0xc
push 0x491b3c
push 0x491b38
lea eax, [ebp - 0x2010]
push eax
call fcn.0040e170
add esp, 0xc
mov cl, byte [0x491b47]
mov byte [ebp - 0x1008], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1007]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x2118]
push edx
push 0x1000
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x2010]
push ecx
lea edx, [ebp - 0x2010]
push edx
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x1008]
test eax, eax
je 0x410709
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2010]
push edx
call fcn.0046b260
add esp, 8
push 0x491b40
push 0x491b44
lea eax, [ebp - 0x2010]
push eax
call fcn.0040e170
add esp, 0xc
push 0x491b38
push 0x491b3c
lea ecx, [ebp - 0x2010]
push ecx
call fcn.0040e170
add esp, 0xc
lea edx, [ebp - 0x2010]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407a50
mov eax, dword [ebp - 0x211c]
or eax, 1
mov dword [ebp - 0x211c], eax
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4111c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 8]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411280
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411276
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0048199e
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411264
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0046b4c0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00481999
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x414ea0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1534
call fcn.0046b3f0
push edi
mov dword [ebp - 0x1528], ecx
mov al, byte [0x4933d3]
mov byte [ebp - 0x1008], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1007]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1008]
push ecx
push 0x8048
call fcn.0040e010
add esp, 8
lea edx, [ebp - 0x151c]
push edx
mov ecx, 0x4b4490
call fcn.004042c0
mov dword [ebp - 0x152c], eax
mov ecx, dword [ebp - 0x152c]
call fcn.0040ee50
push eax
lea eax, [ebp - 0x1008]
push eax
push 0x4933d4
push 0x4933d8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x151c]
call fcn.00407ac0
lea ecx, [ebp - 0x1520]
push ecx
mov ecx, 0x4b4490
call fcn.00404220
mov dword [ebp - 0x1530], eax
mov ecx, dword [ebp - 0x1530]
call fcn.0040ee50
push eax
lea edx, [ebp - 0x1118]
push edx
call fcn.0046b260
add esp, 8
lea ecx, [ebp - 0x1520]
call fcn.00407ac0
push 4
lea eax, [ebp - 0x100c]
push eax
push 3
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x4933e0
lea ecx, [ebp - 0x1518]
push ecx
call fcn.0046b198
add esp, 8
push 0x4933e8
lea edx, [ebp - 0x100c]
push edx
call fcn.0047231a
add esp, 8
test eax, eax
jne 0x414fba
push 0x4933ec
lea eax, [ebp - 0x1518]
push eax
call fcn.0046b198
add esp, 8
push 0x4933f8
lea ecx, [ebp - 0x100c]
push ecx
call fcn.0047231a
add esp, 8
test eax, eax
jne 0x414fe6
push str.ChineseBig5
lea edx, [ebp - 0x1518]
push edx
call fcn.0046b198
add esp, 8
lea eax, [ebp - 0x1524]
push eax
mov ecx, 0x4b4490
call fcn.004042c0
mov dword [ebp - 0x1534], eax
mov ecx, dword [ebp - 0x1534]
call fcn.0040ee50
push eax
lea ecx, [ebp - 0x1518]
push ecx
push 0x493408
push 0x493414
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x1524]
call fcn.00407ac0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x415080
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d12c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2f5c
call fcn.0046b3f0
push edi
mov dword [ebp - 0x2f64], ecx
mov ecx, 0x4d7678
call fcn.00458fc0
mov ecx, 0x4b4490
call fcn.00452f20
cmp dword [0x4b5128], 0
je 0x41512c
cmp dword [0x4b512c], 0
je 0x41512c
push 0
lea ecx, [ebp - 0x2f54]
call fcn.00420650
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2f54]
call fcn.0047d4b0
cmp eax, 2
jne 0x41511a
mov dword [ebp - 0x2f58], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f54]
call fcn.004155c0
mov eax, dword [ebp - 0x2f58]
jmp 0x41532c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f54]
call fcn.004155c0
mov ecx, 0x4b25c8
call fcn.0040e2e0
mov ecx, 0x4b3758
call fcn.00446630
mov dword [ebp - 0x10], eax
mov ecx, 0x4b2b08
call fcn.004456d0
test eax, eax
jne 0x415166
push 0
push 0
push str.Create_Pipe_Failed.
call fcn.00485c96
xor eax, eax
jmp 0x41532c
cmp dword [ebp - 0x10], 0
je 0x41517e
push 0
push 0
push 0
push 2
mov ecx, 0x4b2b08
call fcn.00415480
lea eax, [ebp - 0x2eb4]
push eax
push str.32770
call fcn.0040ebc0
push eax
call dword [sym.imp.USER32.dll_GetClassInfoA]
mov ecx, dword [ebp - 0x2f64]
mov edx, dword [ecx + 0x4c]
mov dword [ebp - 0x2e90], edx
lea eax, [ebp - 0x2eb4]
push eax
call fcn.0047d8b9
lea ecx, [ebp - 0x2eb8]
call fcn.00407a10
mov dword [ebp - 4], 1
mov cl, byte [0x49344f]
mov byte [ebp - 0x2024], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2023]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x2f5c]
push edx
mov ecx, 0x4b4490
call fcn.004042c0
mov dword [ebp - 0x2f68], eax
mov ecx, dword [ebp - 0x2f68]
call fcn.0040ee50
push eax
push 0x1000
lea eax, [ebp - 0x2024]
push eax
push 0x493450
push 0x493454
push 0x493458
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x2f5c]
call fcn.00407ac0
mov cl, byte [0x49345f]
mov byte [ebp - 0x101c], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x101b]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x101c]
push edx
push 0x8048
call fcn.0040e010
add esp, 8
lea eax, [ebp - 0x2024]
push eax
lea ecx, [ebp - 0x101c]
push ecx
call fcn.0046b110
add esp, 8
test eax, eax
jle 0x415281
mov ecx, dword [ebp - 0x2f64]
call fcn.00414ea0
lea ecx, [ebp - 0x2edc]
call fcn.004890ad
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2edc]
push edx
mov ecx, dword [ebp - 0x2f64]
call fcn.00488c91
mov eax, dword [ebp - 0x2ed8]
push eax
call fcn.004528b0
add esp, 4
push 0
lea ecx, [ebp - 0x2e8c]
call fcn.00416250
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2f64]
lea edx, [ebp - 0x2e8c]
mov dword [ecx + 0x1c], edx
lea ecx, [ebp - 0x2e8c]
call fcn.0047d4b0
mov dword [ebp - 0x2028], eax
mov ecx, 0x4b2b08
call fcn.00445d80
mov dword [ebp - 0x2f60], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2e8c]
call fcn.004155e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2edc]
call fcn.004890ec
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2eb8]
call fcn.00407ac0
mov eax, dword [ebp - 0x2f60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4153b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
push str.Global_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00415720
mov ecx, dword [eax + 0x4c]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._is_running
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0x10c]
mov dword [edx + 0xc48], eax
mov eax, dword [ebp - 0x10c]
cmp dword [eax + 0xc48], 0
je 0x41545c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41545c
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ecx + 0xc48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10c]
mov dword [eax + 0xc48], 0
mov ecx, dword [ebp - 0x10c]
xor eax, eax
cmp dword [ecx + 0xc48], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x415480
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
call fcn.0040d520
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 4
je 0x4154e3
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x4155ab
cmp dword [ebp + 0x10], 0
je 0x41552f
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc40]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
je 0x41552f
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x4155ab
cmp dword [ebp + 0x14], 0
je 0x415591
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 4
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc40]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0xc], 4
je 0x415577
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x4155ab
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
mov eax, dword [ebp - 4]
jmp 0x4155ab
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418bd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push edi
mov dword [ebp - 0x418], ecx
cmp dword [0x4afa1c], 0
je 0x418cd8
mov al, byte [0x4937cc]
mov byte [ebp - 0x40c], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x40c]
push edx
call fcn.0046d460
add esp, 8
mov byte [eax], 0
push str.Update.exe
lea eax, [ebp - 0x40c]
push eax
call fcn.0046b270
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x410]
call fcn.00407a50
mov dword [ebp - 0x41c], eax
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], edx
mov dword [ebp - 4], 0
push str.__LocalVersion6.61
mov eax, dword [ebp - 0x420]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.0040e420
add esp, 0xc
mov dword [ebp - 0x424], eax
push 5
mov ecx, dword [ebp - 0x424]
call fcn.0040ee50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x414]
call fcn.00407ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.00407ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4191e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d56b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push edi
mov al, byte [0x491b47]
mov byte [ebp - 0x51c], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x51b]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x51c]
push ecx
call fcn.00404180
add esp, 4
lea ecx, [ebp - 0x410]
call fcn.00407a10
mov dword [ebp - 4], 0
mov dword [ebp - 0x520], 0
jmp 0x419255
mov edx, dword [ebp - 0x520]
add edx, 1
mov dword [ebp - 0x520], edx
mov ecx, dword [ebp + 8]
call fcn.00419860
cmp dword [ebp - 0x520], eax
jae 0x419336
push 0x400
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x520]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00482576
lea ecx, [ebp - 0x410]
call fcn.004196f0
movzx edx, al
test edx, edx
jne 0x419331
lea eax, [ebp - 0x51c]
push eax
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x410]
call fcn.0040ee50
push eax
lea ecx, [ebp - 0x410]
call fcn.0040ee50
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx edx, byte [ebp - 0x40c]
test edx, edx
je 0x419306
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x520]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00419880
push eax
push 0x400
mov edx, dword [ebp - 0x520]
push edx
mov ecx, dword [ebp + 8]
call fcn.004198d0
mov eax, dword [ebp - 0x520]
push eax
mov ecx, dword [ebp + 8]
call fcn.004198a0
test eax, eax
je 0x419331
mov ecx, dword [ebp - 0x520]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004198a0
push eax
call fcn.004191e0
add esp, 4
jmp 0x419246
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.00407ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x419460
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x419482
xor al, al
jmp 0x419500
push 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4194a9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x419500
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4194e0
cmp dword [ebp - 0x20], 2
jne 0x4194dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4194de
jmp 0x4194e0
jmp 0x4194b7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20], 4
jne 0x4194fe
mov al, 1
jmp 0x419500
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x419560
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x419607
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0xa0]
push ecx
push 0x20
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0xb8], 1
lea eax, [ebp - 0xa8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], 2
push 0
push 0
push 0
lea eax, [ebp - 0xb8]
push eax
push 0
mov ecx, dword [ebp - 0xa0]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret

Function at 0x41a720
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0xdc], 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x84
call fcn.0041b130
push 1
push 0x4be
mov ecx, dword [ebp - 4]
call fcn.00480cb6
mov ecx, eax
call fcn.00480e45
push 0
push 0x3e9
mov ecx, dword [ebp - 4]
call fcn.00480cb6
mov ecx, eax
call fcn.00480e45
mov esp, ebp
pop ebp
ret
Function at 0x41d420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d8a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x78], 0
jne 0x41d4e0
lea ecx, [ebp - 0x10]
call fcn.00407a10
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00407b60
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0041dc50
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.004047d0
lea ecx, [ebp - 0x10]
call fcn.0040ee50
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41d4c7
push 0x6a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41d4c7
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x78], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41d760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x208]
push eax
push 0x494934
push closesocket
mov ecx, dword [ebp - 0x210]
call fcn.0041d4f0
test eax, eax
jne 0x41d875
push str._shellopencommand
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x208]
push eax
push closesocket
mov ecx, dword [ebp - 0x210]
call fcn.0041d4f0
test eax, eax
jne 0x41d875
push 0x494950
lea ecx, [ebp - 0x208]
push ecx
call fcn.00405240
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x41d838
push 0x494958
lea edx, [ebp - 0x208]
push edx
call fcn.0046b360
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x41d82d
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x209]
mov dword [ebp - 0x20c], ecx
jmp 0x41d836
mov edx, dword [ebp - 0x20c]
mov byte [edx], 0
jmp 0x41d841
mov eax, dword [ebp - 0x20c]
mov byte [eax], 0
push 0x49495c
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x41d877
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x422080
Capabilities:
Create service
Delete service
Persist via windows service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x103c
call fcn.0046b3f0
mov dword [ebp - 0x103c], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x42219e
push 0xf01ff
mov eax, dword [ebp - 0x103c]
add eax, 0x8c
push eax
mov ecx, dword [ebp - 0x100c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
je 0x42217b
lea edx, [ebp - 0x1030]
push edx
push 1
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x422145
lea ecx, [ebp - 0x1030]
push ecx
mov edx, dword [ebp - 0x1010]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x422132
cmp dword [ebp - 0x102c], 3
jne 0x42212e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x422130
jmp 0x422132
jmp 0x422100
cmp dword [ebp - 0x102c], 1
je 0x422145
mov dword [ebp - 0x1014], 0
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x422162
mov dword [ebp - 0x1034], 1
jmp 0x42216c
mov dword [ebp - 0x1038], 0
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x422185
mov dword [ebp - 0x1014], 1
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1014], 1
jmp 0x4221a8
mov dword [ebp - 0x1014], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
jne 0x4221cd
xor eax, eax
jmp 0x42228f
push 0x7d0
lea eax, [ebp - 0x1000]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4221ec
xor eax, eax
jmp 0x42228f
push str._service
lea ecx, [ebp - 0x1000]
push ecx
push 0x495854
lea edx, [ebp - 0x800]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x800]
push eax
push 1
push 2
push 0x110
push 0xf01ff
mov ecx, dword [ebp - 0x103c]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x103c]
add edx, 0x8c
push edx
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x422270
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x42228f
mov edx, dword [ebp - 0x1008]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4222a0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x422374
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 0x8c
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42235a
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x422330
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x422323
cmp dword [ebp - 0x24], 3
jne 0x42231f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x422321
jmp 0x422323
jmp 0x4222fa
cmp dword [ebp - 0x24], 1
je 0x422330
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x422347
mov dword [ebp - 0x2c], 1
jmp 0x42234e
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x422361
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0xc], 1
jmp 0x42237b
mov dword [ebp - 0xc], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret