joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdf2000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdf2131
push esi
call fcn.00df5145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00de4080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdf2131
push 0
push ebp
call fcn.00de43a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00de4260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdf208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00de42f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdf2121
push 0xe0a918
push edi
call fcn.00df33f0
push eax
push ebx
push esi
call fcn.00df1f60
push 0xe0a8f8
push edi
call fcn.00df33f0
push eax
push ebx
push esi
call fcn.00df1f60
push 0xe0a8d8
push edi
call fcn.00df33f0
push eax
push ebx
push esi
call fcn.00df1f60
push 0xe0a8c0
push edi
call fcn.00df33f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00df1f60
push 0xe0a8a0
push edi
call fcn.00df33f0
push eax
push ebx
push esi
call fcn.00df1f60
push 0xe0a888
push edi
call fcn.00df33f0
push eax
push ebx
push esi
call fcn.00df1f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xdf31b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00df3140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00df3140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00df3140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00df3140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdf3bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdf3c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe0587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdf3c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdf3c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x46a7d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x46f4cc]
cmp dword [eax + 0x28], 0
jne 0x46a7e8
xor eax, eax
jmp 0x46a917
mov ecx, dword [0x46f43c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x46f430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x46f42c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x46f430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x46f42c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x46f4b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x46e760
push 0x46e77c
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x46f428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0046a710
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x46a7a0
mov edx, dword [0x46f4cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x46f434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x46a917
cmp dword [ebp - 0x38], 0x12
jne 0x46a90b
mov dword [0x46f444], 0
call fcn.0046a920
xor eax, eax
jmp 0x46a917
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x46a8dc
mov esp, ebp
pop ebp
ret 4

Function at 0x46bcd0
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x46c6ac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x46e140
sub eax, eax
test esi, esi
je 0x46c784
sub eax, 1
test ecx, ecx
je 0x46c782
test esi, 3
je 0x46c6ea
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x46c6cf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x46c769
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x46c6f4
mov ecx, edx
test ecx, ecx
je 0x46c782
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x46c76f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x46c78c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0046c80f
jae 0x46c79a
xor ecx, ecx
call fcn.0046c80f
jae 0x46c7c9
xor eax, eax
call fcn.0046c80f
jae 0x46c7d9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0046c80f
adc al, al
jae 0x46c7bb
jne 0x46c805
stosb byte es:[edi], al
jmp 0x46c79d
call fcn.0046c81b
sub ecx, ebx
jne 0x46c7e2
call fcn.0046c819
jmp 0x46c801
lodsb al, byte [esi]
shr eax, 1
je 0x46c82b
adc ecx, ecx
jmp 0x46c7fe
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0046c819
cmp eax, 0x7d00
jae 0x46c7fe
cmp ah, 5
jae 0x46c7ff
cmp eax, 0x7f
ja 0x46c800
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x46c79d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x46d15c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46f000]
jne 0x46d166
repz ret
jmp fcn.0046d40d
Function at 0x403b30
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42c270
push 0x41da10
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x42e0a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x500
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x403bcb
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x403bb1
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x28]
jmp 0x403bcb
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041ac16
mov esp, ebp
pop ebp
ret

Function at 0x403bf0
Capabilities:
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42c2f0
push 0x41da10
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x42e0a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
mov byte [ebp - 0x120], al
push 0x103
push eax
lea eax, [ebp - 0x11f]
push eax
call fcn.0041c670
add esp, 0xc
mov dword [ebp - 0x12c], 0x104
lea ecx, [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x403ccd
mov edx, 6
mov dword [ebp - 0x130], edx
lea ecx, [ebp - 0x120]
or eax, 0xffffffff
mov dword [ebp - 0x124], ecx
mov esi, edx
dec edx
mov dword [ebp - 0x130], edx
test esi, esi
je 0x403cac
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42b380]
inc ecx
jmp 0x403c81
not eax
xor ecx, ecx
cmp eax, 0x39b5d60d
sete cl
mov esi, ecx
jmp 0x403cc7
mov dword [ebp - 0x128], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041ac16
mov esp, ebp
pop ebp
ret
Function at 0x404970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x45b9a0
call fcn.0041a617
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x404a24
test esi, esi
jne 0x404a24
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x404a08
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404a02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404a02
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x4049f1
cmp esi, eax
jae 0x4049f5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4049e3
cmp esi, eax
jb 0x4049f9
xor eax, eax
jmp 0x404a02
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x404a2d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x45b9a0
call fcn.0041a617
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x404995
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404b48
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404b7a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x404b76
cmp esi, eax
jae 0x404b7a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404b68
cmp esi, eax
jb 0x404b80
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x407820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427d28
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42e0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x38]
push 0x45b178
xor ebx, ebx
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.00408480
add esp, 8
mov edi, dword [ebp - 0x38]
cmp dword [edi - 0xc], ebx
je 0x407975
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
lea ebx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00408030
mov edi, dword [ebp - 0x44]
test eax, eax
jne 0x407968
test edi, edi
je 0x407973
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], ax
lea esi, [eax + 1]
mov ebx, 7
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
call fcn.00407cc0
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov byte [ebp - 4], 3
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4078d0
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [ebp - 0x30]
call fcn.00407a80
push 1
mov eax, 0x42b870
lea ecx, [ebp - 0x30]
call fcn.00407a80
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp esi, 8
jae 0x407905
lea eax, [ebp - 0x30]
lea edx, [eax + 2]
jmp 0x407910
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407910
mov ecx, dword [ebp - 0x30]
sub eax, edx
sar eax, 1
cmp esi, 8
jae 0x40792a
lea ecx, [ebp - 0x30]
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 0x34]
push edx
push ecx
push 2
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x1c], 8
jb 0x407958
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0041ac0b
add esp, 4
xor edx, edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], dx
test edi, edi
je 0x407973
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4079a9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041ac16
mov esp, ebp
pop ebp
ret
Function at 0x4080f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x42e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x42b8d0
push str.Kernel32.dll
mov dword [ebp - 0x620], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x42b8e0
push 0x42b8ec
mov edi, eax
call ebx
push eax
call esi
push 0x42b8f8
push 0x42b8ec
mov dword [ebp - 0x624], eax
call ebx
push eax
call esi
mov esi, eax
test edi, edi
je 0x40826a
mov ebx, dword [ebp - 0x624]
test ebx, ebx
je 0x40826a
test esi, esi
je 0x40826a
push 0x40
lea ecx, [ebp - 0x674]
push 0
push ecx
call fcn.0041c670
xor eax, eax
xor edx, edx
push 0x206
mov word [ebp - 0x648], dx
push eax
lea edx, [ebp - 0x20a]
xor ecx, ecx
push edx
mov dword [ebp - 0x678], 0x44
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x628], eax
mov word [ebp - 0x20c], cx
call fcn.0041c670
add esp, 0x18
push 0
push 0x25
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x42b90c
lea ecx, [ebp - 0x20c]
push ecx
call ebx
push 0
lea edx, [ebp - 0x20c]
push edx
call esi
xor eax, eax
push 0x40e
push eax
lea ecx, [ebp - 0x61a]
push ecx
mov word [ebp - 0x61c], ax
call fcn.0041c670
mov edx, dword [ebp - 0x620]
push edx
lea eax, [ebp - 0x20c]
push eax
push str.__s__start___s_
lea ecx, [ebp - 0x61c]
push 0x208
push ecx
call fcn.0041b611
add esp, 0x20
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x678]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ac16
mov esp, ebp
pop ebp
ret
Function at 0x408280
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42e0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x20]
xor esi, esi
push 0x45aae0
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], esi
call fcn.00408480
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp dword [ecx - 0xc], esi
je 0x4083aa
push 5
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x4083aa
mov edx, dword [ebp - 0x20]
push 0x17
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], eax
cmp ebx, esi
je 0x4083a0
lea eax, [ebp - 0x18]
push eax
push esi
push esi
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
push ebx
call esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, ecx
je 0x40838c
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
push eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x11]
lea edi, [ebp - 0x34]
mov byte [ebp - 0x11], cl
call fcn.00405140
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
sub eax, edi
cmp eax, dword [ebp - 0x18]
jne 0x40837f
test edi, edi
je 0x40837f
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push ebx
call esi
test eax, eax
je 0x40837f
cmp dword [edi + 4], 2
je 0x40837f
mov edx, dword [edi + 8]
mov eax, dword [edi]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 2
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea esi, [ebp - 0x34]
call fcn.00405110
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
push ecx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4083da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4083da
cmp ebx, esi
je 0x4083e5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x4083f3
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408b40
Capabilities:
Check if file exists
Create process on windows
Delete file
Extract resource via kernel32 functions
Move file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x42e0a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x408d29
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408b83
sub eax, edx
sar eax, 1
je 0x408d29
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408d29
push 0x14
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x408d1b
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebx
je 0x408d29
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x408d29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x408d29
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x30]
push ecx
push edi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00405090
add esp, 8
cmp eax, ebx
je 0x408d02
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
cmp edi, esi
je 0x408d02
mov edx, dword [ebp + 8]
push 0x42b94c
push edx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0041b6ed
add esp, 0xc
test eax, eax
jne 0x408d02
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x408d02
push eax
sub esi, edi
push esi
push 1
push edi
call fcn.0041b88b
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.0041b972
add esp, 0x14
cmp esi, ebx
je 0x408d02
lea esi, [ebp - 0x20]
call fcn.004043d0
push 0x6b
mov byte [ebp - 4], 2
call fcn.00404970
add esp, 4
cmp eax, ebx
je 0x408cfa
push eax
mov eax, 0x6b
mov edi, esi
call fcn.00404540
cmp eax, ebx
je 0x408cfa
mov edi, dword [ebp - 0x20]
cmp dword [edi - 0xc], ebx
je 0x408cfa
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004043f0
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0040af40
mov eax, edi
call fcn.0040ae20
cmp eax, ebx
je 0x408cf2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x408cf2
mov eax, dword [ebp - 0x14]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
call fcn.0040a8f0
lea eax, [ebp - 0x20]
call fcn.0040a8f0
lea esi, [ebp - 0x30]
call fcn.00405110
jmp 0x408d29
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret