joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009278
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x1000957d
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
push 4
pop ebx
lea edx, [esi + 3]
mov ebp, ebx
lea ecx, [edi + 1]
sub esi, edi
mov al, byte [edx - 3]
mov byte [ecx - 1], al
mov al, byte [ecx + esi]
mov byte [ecx], al
mov al, byte [edx - 1]
mov byte [ecx + 1], al
mov al, byte [edx]
add edx, ebx
mov byte [ecx + 2], al
add ecx, ebx
sub ebp, 1
jne 0x10009597
lea ecx, [edi + 0xd]
mov ah, byte [ecx]
lea edx, [ecx]
mov al, byte [edx - 1]
mov cl, byte [edx + 2]
mov byte [esp + 0x10], al
mov al, ah
mov ah, byte [edx + 1]
mov byte [esp + 0x12], al
mov byte [esp + 0x13], ah
mov byte [esp + 0x11], cl
test bl, 3
jne 0x10009620
movzx ecx, al
movzx eax, ah
mov al, byte [eax + str.cw]
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x11]
mov al, byte [eax + str.cw]
mov byte [esp + 0x13], al
movzx eax, byte [esp + 0x10]
mov al, byte [eax + str.cw]
mov byte [esp + 0x11], al
mov eax, ebx
shr eax, 2
mov al, byte [eax + 0x10020690]
xor al, byte [ecx + str.cw]
mov byte [esp + 0x10], al
mov al, byte [edx - 0xd]
lea ecx, [edx + 4]
xor al, byte [esp + 0x10]
mov byte [edx + 3], al
mov ah, byte [edx - 0xc]
xor ah, byte [esp + 0x12]
mov byte [ecx], ah
mov al, byte [edx - 0xb]
xor al, byte [esp + 0x13]
mov byte [edx + 5], al
mov al, byte [edx - 0xa]
xor al, byte [esp + 0x11]
inc ebx
mov byte [edx + 6], al
cmp ebx, 0x2c
jb 0x100095bb
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000927d
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [esp + 4]
mov edx, dword [esp + 8]
push esi
push edi
shl ecx, 4
add ecx, dword [esp + 0x14]
push 4
pop edi
push 4
pop esi
mov al, byte [ecx]
xor byte [edx], al
inc ecx
inc edx
sub esi, 1
jne 0x10009295
sub edi, 1
jne 0x10009292
pop edi
pop esi
ret
Function at 0x1000a630
Capabilities:
Execute syscall

Disassembly:
pop eax
call fcn.1000906b
add esp, 4
mov ecx, dword fs:[0xc0]
test ecx, ecx
jne 0x1000a64b
lea edx, [esp + 4]
int 0x2e
ret
xor ecx, ecx
lea edx, [esp + 4]
call dword fs:[0xc0]
ret

Function at 0x1001f9c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001f9ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001f9ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a7004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x4a8db0], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a8db0], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a8db4], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a8db8], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x4a8dc0], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x4a8dbc], eax
mov eax, dword [0x4a8dbc]
cmp eax, ebx
je 0x40575e
cmp dword [0x4a8dc0], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x4a8dc0]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x4a8db4]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x4a8db8]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a8db0]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a4af9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x4b6d24]
push dword [0x4b6a40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x4a4b88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x4a4bb2
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.004a4b7d
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x4a4b95
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
jne 0x4a4bca
or dword [0x4b6d34], 0xffffffff
mov dword [0x4b6d30], 0xa62e7790
leave
ret
Function at 0x4044ba
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0xff
xor eax, dword [0x406e08]
mov ecx, dword [0x406e08]
shr ecx, 8
and eax, edx
mov eax, dword [eax*4 + 0x406e30]
xor eax, ecx
mov dword [0x406e08], eax
and eax, edx
add dword [0x406e0c], eax
mov eax, dword [0x406e0c]
imul eax, eax, 0x8088405
inc eax
mov ecx, dword [0x406e10]
shr ecx, 8
mov dword [0x406e0c], eax
shr eax, 0x18
xor eax, dword [0x406e10]
and eax, edx
mov eax, dword [eax*4 + 0x406e30]
xor eax, ecx
mov dword [0x406e10], eax
ret

Function at 0x4045af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [0x4067e0]
mov ebp, esp
sub esp, 0xc
push esi
push edi
push eax
call fcn.0040451e
add esp, 4
lea ecx, [ebp - 0xc]
xor edi, edi
push 0xc
push dword [ebp + 8]
push ecx
call section..text
add esp, 0xc
lea esi, [ebp + edi - 0xc]
call fcn.004044a1
inc edi
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004044ba
add esp, 4
cmp edi, 0xc
jl 0x4045d8
cmp dword [0x4067dc], 0
movzx cx, byte [ebp - 1]
je 0x404619
mov ax, word [0x407366]
shr ax, 8
cmp ax, cx
je 0x40462b
mov eax, 0xffffffff
jmp 0x40462d
mov eax, dword [0x40736a]
shr eax, 0x18
cmp ax, cx
mov eax, 0xffffffff
jne 0x40462d
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x35937295
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x48d5357a
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401258
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xe8
push ebx
push esi
mov esi, dword [ebp + 0x78]
push edi
push dword [ebp + 0x7c]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [esi + 0x18]
call edi
push 9
push dword [esi + 0x18]
mov dword [ebp + 0x6c], eax
call edi
mov dword [ebp + 0x78], eax
push 0x64
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x6c]
xor ebx, ebx
mov word [ebp - 0x78], bx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp + 0x64]
push eax
push dword [esi + 0x18]
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
lea edi, [ebp + 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 0x58]
mov eax, dword [ebp + 0x54]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
push 4
sub edi, ecx
sub ecx, dword [ebp + 0x68]
push edi
sub esi, eax
sub eax, dword [ebp + 0x64]
push esi
push ecx
push eax
push ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push edi
push esi
push dword [ebp + 0x58]
push dword [ebp + 0x54]
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_MoveWindow]
push ebx
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
Function at 0x402f13
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x18
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
push 0xb
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x18]
push eax
call fcn.0042d14b
cmp eax, 1
pop ecx
pop edi
jle 0x402f54
mov word [0x49a010], ax
leave
ret

Function at 0x402f98
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x496b90]
test ecx, ecx
jle 0x402fcb
mov dword [0x496b90], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x496b90], eax
jmp 0x403003
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call edi
call esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x402ffb
sub eax, dword [0x496b90]
cmp eax, dword [ebp + 8]
jae 0x40300b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x495280], bl
jg 0x402fdb
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x496b90]
pop esi
test ecx, ecx
jle 0x403020
mov dword [0x496b90], eax
xor eax, eax
cmp byte [0x495280], bl
pop edi
setg al
pop ebx
leave
ret

Function at 0x4031f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf
xor eax, eax
cmp byte [ebp + 0x10], bl
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
je 0x40322b
or dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40326a
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0xc], bl
je 0x403264
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40326e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x3ff
lea eax, [ebp - 0x400]
push eax
push str.SHOWEWFMSG
mov byte [ebp - 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x400], 0x31
jne 0x4032b0
push 0
push 0x480b9c
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x4032b2
Capabilities:
Terminate process

Disassembly:
cmp byte [0x495280], 2
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
pop esi
je 0x4032c9
push esi
call edi
cmp dword [0x496b9c], 0
je 0x4032e4
push 0x1e
pop esi
jmp 0x4032e4
cmp dword [0x496b94], 0
je 0x4032e7
push 0xa
call edi
dec esi
jns 0x4032d7
mov eax, dword [0x496b94]
test eax, eax
pop edi
pop esi
je 0x403305
push 0
push eax
mov dword [0x496b94], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [0x495280], 0xff
ret

Function at 0x40330d
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0xc]
mov esi, 0x8000004
push 0x64
push ebx
push esi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
mov byte [ebp - 1], 1
je 0x40334e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40335f
mov byte [ebp - 1], bl
jmp 0x40335f
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x40339b
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [0x496ba4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x496ba4]
cmp eax, ebx
je 0x40339b
cmp byte [ebp - 1], bl
je 0x403396
push 0x64
push ebx
push eax
call fcn.0046c9b0
mov eax, dword [0x496ba4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4035e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x169
lea ecx, [ebp - 4]
call fcn.0042c827
mov ebx, dword [ebp - 4]
push 0x104
push dword [ebp + 0xc]
add ebx, 0xc8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 8]
push eax
xor esi, esi
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4036a6
push edi
push eax
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x480bd8
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
push 0x480bc0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov dword [esi], eax
call fcn.00427365
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40408f
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], eax
push ebx
lea ecx, [eax + 8]
push edi
mov di, word [eax]
mov dword [ebp - 4], ecx
mov ax, word [ecx]
call fcn.00402a89
test al, al
jne 0x4040b4
inc ecx
inc ecx
mov dword [ebp - 4], ecx
push 0x63
lea eax, [ebp - 0x74]
push eax
xor ebx, ebx
push str.DEBUGMDG
mov byte [ebp - 0x74], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x74], 0x31
jne 0x4040d7
mov byte [0x496b8c], 1
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp - 4]
lea ecx, [ebp - 0x10]
mov dword [0x496b90], eax
mov dword [ebp - 0xc], ebx
call fcn.004365ba
lea ecx, [ebp - 8]
call fcn.0042c809
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
mov ecx, 0x496eb8
call fcn.0043c527
push dword [ebp - 8]
lea ecx, [ebp - 0xc]
call fcn.0043667e
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
call fcn.00427365
lea ecx, [ebp - 0x10]
call fcn.00427365
mov ecx, dword [ebp - 4]
call fcn.0040302f
push 0x1e
push eax
push str._InstallService
mov dword [ebp - 4], eax
mov esi, eax
call fcn.0046ca20
add esp, 0xc
test eax, eax
jne 0x404185
movzx esi, word [esi + 0x1e]
mov eax, esi
call fcn.00402a89
test al, al
jne 0x404163
cmp si, bx
jne 0x404185
push 0x1e
push 0x480e44
push dword [ebp - 4]
call fcn.0046cbf0
mov ecx, dword [ebp - 4]
add esp, 0xc
add ecx, 0x1e
call fcn.0040302f
mov dword [ebp - 4], eax
jmp 0x40419c
push 8
lea eax, [ebp - 4]
push eax
push 0x480e38
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4041df
cmp di, 0x22
jne 0x4041d5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea ecx, [edx + eax*2 - 2]
cmp ecx, edx
jbe 0x4041d5
mov ax, word [ecx]
call fcn.00402a89
test al, al
je 0x4041c8
dec ecx
dec ecx
cmp ecx, edx
ja 0x4041b6
cmp ecx, edx
jbe 0x4041d5
cmp word [ecx], 0x22
jne 0x4041d5
mov word [ecx], bx
push dword [ebp - 4]
call fcn.00409e2c
jmp 0x4041ff
push 0xe
lea eax, [ebp - 4]
push eax
push 0x480e28
call fcn.0042e2da
add esp, 0xc
test al, al
pop esi
je 0x404207
push dword [ebp - 4]
call fcn.00404c7f
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xc]
call fcn.00427365
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x404215
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x496b94], 0
call ebx
and dword [esi], 0
test edi, edi
je 0x404254
mov eax, dword [edi]
test eax, eax
je 0x404254
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push dword [edi]
call ebx
and dword [edi], 0
cmp byte [esp + 0x10], 0
je 0x40426c
push 1
push 0
push str.shutdown__a
call fcn.004031f5
add esp, 0xc
push dword [0x496bdc]
call fcn.00403174
cmp byte [esp + 0x10], 0
pop ecx
je 0x404298
push 3
pop esi
push 0
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x404282
pop esi
pop ebx
ret
Function at 0x404ad2
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [0x496b98], ecx
mov dword [ebp - 0xc], edi
xor ebx, ebx
jmp 0x404afa
call fcn.00402a89
test al, al
jne 0x404b02
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x404aef
sub ecx, edi
sar ecx, 1
mov eax, 0x400
cmp ecx, eax
jle 0x404b11
mov ecx, eax
lea esi, [ecx + ecx]
push esi
lea eax, [ebp - 0x820]
push edi
push eax
call fcn.0046cbf0
add esp, 0xc
push edi
mov word [ebp + esi - 0x820], bx
mov byte [0x49a003], bl
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
lea eax, [edi + 0x226]
push eax
lea ecx, [ebp - 4]
call fcn.0042c827
mov eax, dword [ebp - 4]
push 0x1cc
add eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
cmp ecx, ebx
jle 0x404c72
mov eax, dword [ebp - 4]
mov word [eax + ecx*2 + 2], bx
mov eax, dword [ebp - 4]
lea esi, [eax + ecx*2 + 2]
mov dword [ebp - 8], esi
lea edx, [eax + 2]
xor esi, esi
mov word [eax], 0x22
jmp 0x404b98
mov ax, word [edx]
call fcn.00402a89
test al, al
je 0x404b96
xor esi, esi
inc esi
inc edx
inc edx
cmp edx, dword [ebp - 8]
jb 0x404b87
cmp si, bx
mov edx, dword [ebp - 4]
lea eax, [edx + 2]
mov dword [ebp - 8], eax
je 0x404bb9
dec eax
dec eax
mov word [edx + ecx*2 + 2], 0x22
inc ecx
mov dword [ebp - 8], eax
inc ecx
push 0x1e
lea esi, [eax + ecx*2]
push 0x480fd8
push esi
call fcn.0046cbf0
push edi
push dword [ebp - 0xc]
add esi, 0x1e
push esi
call fcn.00403c6b
add esp, 0x18
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x404c64
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0x820]
push ebx
push 2
push 0x110
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
je 0x404c64
push eax
call esi
push 0x20000000
lea eax, [ebp - 0x820]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x404c5d
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x404c4b
push 0x480fcc
jmp 0x404c50
push 0x480fc0
call fcn.0040326e
pop ecx
push dword [ebp - 0xc]
call esi
jmp 0x404c6f
push 0x480fb4
jmp 0x404c69
push 0x480fa8
call fcn.0040326e
pop ecx
push edi
call esi
lea ecx, [ebp - 4]
call fcn.00427365
pop edi
pop esi
pop ebx
leave
ret