joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f5850
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f5896
push dword fs:[eax]
mov dword fs:[eax], esp
push eax
push ebx
push ecx
push edx
mov eax, 0x564d5868
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
pop edx
pop ecx
pop ebx
pop eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5f58a0
cmp dword [ebp - 4], 0x564d5868
jne 0x5f58e4
mov al, 1
mov edx, dword [ebp - 8]
dec edx
je 0x5f58bc
dec edx
je 0x5f58c4
dec edx
je 0x5f58cc
dec edx
je 0x5f58d4
jmp 0x5f58dc
mov edx, dword [ebp - 0xc]
mov byte [edx], 1
jmp 0x5f58ec
mov edx, dword [ebp - 0xc]
mov byte [edx], 2
jmp 0x5f58ec
mov edx, dword [ebp - 0xc]
mov byte [edx], 3
jmp 0x5f58ec
mov edx, dword [ebp - 0xc]
mov byte [edx], 4
jmp 0x5f58ec
mov edx, dword [ebp - 0xc]
mov byte [edx], 5
jmp 0x5f58ec
xor eax, eax
mov edx, dword [ebp - 0xc]
mov byte [edx], 6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5f5a74
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5f5ac3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x5f627c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5f63bd
push dword fs:[eax]
mov dword fs:[eax], esp
and byte [ebx], dh
fild dword [ecx + 0x1fe]
invalid
jne 0x5f62c6
lea eax, [ebp - 0x18]
push eax
push esi
call sub.advapi32.dll_RegOpenCurrentUser
test eax, eax
jne 0x5f63a2
jmp 0x5f62c9
mov dword [ebp - 0x18], esi
mov edx, dword [ebp - 4]
Function at 0x5f63d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5f654f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp esi, 0x80000001
jne 0x5f641a
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_RegOpenCurrentUser
test eax, eax
jne 0x5f6534
jmp 0x5f641d
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.005f6194
mov edi, eax
test edi, edi
jle 0x5f6523
lea eax, [ebp - 8]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a7fc
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5f6523
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x5f6483
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.0040a7fc
cmp dword [ebp - 8], 0
jne 0x5f64a1
xor edi, edi
jmp 0x5f64ab
mov eax, dword [ebp - 8]
call fcn.0040a3d8
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5f651a
mov eax, dword [ebp - 0x1c]
call fcn.00406a34
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5f6512
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x5f6508
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov bl, 1
jmp 0x5f651a
mov eax, dword [ebp - 0x18]
call fcn.00406a50
jmp 0x5f651a
mov eax, dword [ebp - 0x18]
call fcn.00406a50
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
cmp esi, 0x80000001
jne 0x5f6534
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f6556
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret
Function at 0x5f68d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5f69dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp esi, 0x80000001
jne 0x5f691f
lea eax, [ebp - 0x10]
push eax
push esi
call sub.advapi32.dll_RegOpenCurrentUser
test eax, eax
jne 0x5f69c1
jmp 0x5f6922
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.005f6194
mov edi, eax
test edi, edi
jle 0x5f69b0
lea eax, [ebp - 8]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a7fc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5f69b0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5f6975
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.0040a7fc
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
cmp esi, 0x80000001
jne 0x5f69c1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f69e3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret
Function at 0x5f6acc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5f6bc8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp esi, 0x80000001
jne 0x5f6b13
lea eax, [ebp - 0x10]
push eax
push esi
call sub.advapi32.dll_RegOpenCurrentUser
test eax, eax
jne 0x5f6bad
jmp 0x5f6b16
mov dword [ebp - 0x10], esi
mov edx, dword [ebp - 4]
mov ax, 0x5c
call fcn.005f6194
mov edi, eax
test edi, edi
jle 0x5f6b9c
lea eax, [ebp - 8]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a7fc
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5f6b9c
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5f6b69
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, edi
lea edx, [edi + 1]
mov eax, dword [ebp - 4]
call fcn.0040a7fc
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
cmp esi, 0x80000001
jne 0x5f6bad
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f6bcf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret
Function at 0x5fa4d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040bba8
mov eax, dword [ebp - 8]
call fcn.0040bba8
xor eax, eax
push ebp
push 0x5fa66b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
lea ebx, [ebp - 0x118]
lea esi, [ebp - 0x218]
mov byte [ebx], cl
mov edi, dword [ebp - 8]
test edi, edi
je 0x5fa527
sub edi, 4
mov edi, dword [edi]
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp - 8]
movzx eax, byte [eax + edx]
mov byte [esi], al
inc ecx
inc esi
inc ebx
cmp ecx, 0x100
jne 0x5fa519
xor edx, edx
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0x118]
lea esi, [ebp - 0x218]
movzx ebx, byte [eax]
add edx, ebx
movzx ebx, byte [esi]
add edx, ebx
and edx, 0x800000ff
jns 0x5fa56d
dec edx
or edx, 0xffffff00
inc edx
movzx ebx, byte [eax]
mov byte [ebp - 0xd], bl
movzx ebx, byte [ebp + edx - 0x118]
mov byte [eax], bl
movzx ebx, byte [ebp - 0xd]
mov byte [ebp + edx - 0x118], bl
inc esi
inc eax
dec ecx
jne 0x5fa553
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
test eax, eax
je 0x5fa59d
sub eax, 4
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x5fa639
inc eax
mov dword [ebp - 0x14], 0
inc ecx
and ecx, 0x800000ff
jns 0x5fa5bf
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ebx, byte [ebp + ecx - 0x118]
add edx, ebx
and edx, 0x800000ff
jns 0x5fa5d9
dec edx
or edx, 0xffffff00
inc edx
movzx ebx, byte [ebp + ecx - 0x118]
mov byte [ebp - 0xd], bl
movzx ebx, byte [ebp + edx - 0x118]
mov byte [ebp + ecx - 0x118], bl
movzx ebx, byte [ebp - 0xd]
mov byte [ebp + edx - 0x118], bl
movzx ebx, byte [ebp + ecx - 0x118]
movzx esi, byte [ebp + edx - 0x118]
add ebx, esi
and ebx, 0xff
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x14]
lea esi, [ebx + esi]
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebp + ebx - 0x118]
xor byte [esi], bl
inc dword [ebp - 0x14]
dec eax
jne 0x5fa5ae
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, dword [0x4046c0]
call fcn.0040bb6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fa672
lea eax, [ebp - 8]
mov edx, dword [0x4046c0]
mov ecx, 2
call fcn.0040ad90
ret

Function at 0x5faf3c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.005f6d44
ret

Function at 0x5fb954
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040a47c
add esp, 0x210
pop ebx
ret
Function at 0x5fbed4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5fbfa6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a3d8
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4046c0]
call fcn.0040ba04
add esp, 4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.005f6d44
xor ebx, ebx
mov eax, dword [ebp - 8]
push eax
push 0x1000
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5fbf82
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5fbfb8
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5fbf82
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fbfad
lea eax, [ebp - 8]
mov edx, dword [0x4046c0]
call fcn.0040bb28
lea eax, [ebp - 4]
call fcn.00409834
ret
Function at 0x5fbfbc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x5fc10c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409834
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a3d8
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4046c0]
call fcn.0040ba04
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.005f6d44
mov eax, dword [ebp - 8]
push eax
push 0x1000
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5fc0db
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5fc11c
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5fc0db
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.005fb27c
push dword [ebp - 0x14]
push 0x5fc12c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.005fb27c
push dword [ebp - 0x18]
push 0x5fc12c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.005fb27c
push dword [ebp - 0x1c]
push 0x5fc12c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.005fb27c
push dword [ebp - 0x20]
mov eax, esi
mov edx, 7
call fcn.0040a6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fc113
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00409894
lea eax, [ebp - 8]
mov edx, dword [0x4046c0]
call fcn.0040bb28
lea eax, [ebp - 4]
call fcn.00409834
ret
Function at 0x623724
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6237a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409834
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x623765
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x623793
mov esi, dword [ebx + 0xc]
xor ebx, ebx
jmp 0x62378c
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x48]
call fcn.005fd3c0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0040a498
jmp 0x623793
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x623770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6237b0
lea eax, [ebp - 0x48]
call fcn.00409858
ret

Function at 0x623b44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x623cb3
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x623cd0
call fcn.005fb4f0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x623c90
lea eax, [ebp - 0xc]
mov edx, 0x400
call fcn.0040a554
mov eax, dword [ebp - 0xc]
call fcn.005fb170
push eax
lea eax, [ebp - 0xc]
call fcn.00409db4
xor ecx, ecx
pop edx
call fcn.0040748c
mov eax, dword [ebp - 0xc]
call fcn.005fb170
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040a3d8
push eax
push 0
push 0
push 0x623d8c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x623c87
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x623c15
sub eax, 4
mov eax, dword [eax]
cmp eax, 3
jl 0x623c87
lea eax, [ebp - 0x24]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040a7fc
mov eax, dword [ebp - 0x24]
mov edx, 0x623db4
call fcn.0040a7c4
jne 0x623c87
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x623dbc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 2
je 0x623c74
test eax, eax
jne 0x623c78
cmp dword [ebp - 0x18], 1
jne 0x623c78
xor ebx, ebx
jmp 0x623c87
test eax, eax
jne 0x623c87
cmp dword [ebp - 0x18], 2
jne 0x623c87
mov ebx, 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x623cba
lea eax, [ebp - 0x24]
call fcn.00409834
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409894
ret
Function at 0x623e04
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x623f44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00409834
lea eax, [ebp - 0xe]
xor ecx, ecx
mov edx, 6
call fcn.0040748c
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
call sub.Iphlpapi.dll_GetAdaptersInfo
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x623dd8]
call fcn.0040ba04
add esp, 4
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.Iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x623ec3
test ebx, ebx
je 0x623ec3
lea edx, [ebp - 0x18]
lea eax, [ebx + 8]
call fcn.005fd3c0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.0040a498
mov eax, dword [ebp - 8]
call fcn.00623b44
mov esi, eax
cmp esi, 1
je 0x623ea6
test esi, esi
jne 0x623ebd
lea edx, [ebp - 0xe]
lea eax, [ebx + 0x194]
mov ecx, 6
call fcn.00406c74
test esi, esi
je 0x623ec3
mov ebx, dword [ebx]
test ebx, ebx
jne 0x623e7d
push edi
movzx eax, byte [ebp - 0xe]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0xd]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0xc]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0xb]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, byte [ebp - 0xa]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 9]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x48]
mov ecx, 5
mov eax, 0x623f60
call fcn.005fb4f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x623f4b
lea eax, [ebp - 0x18]
call fcn.00409858
lea eax, [ebp - 8]
call fcn.00409834
lea eax, [ebp - 4]
mov edx, dword [0x623dd8]
call fcn.0040bb28
ret

Function at 0x625384
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
mov eax, dword [ebp - 8]
call fcn.00409918
xor eax, eax
push ebp
push 0x62542f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
je 0x625414
push 0
push 0
push 0x625440
push 0
push 0x625450
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040a3d8
mov edi, eax
push edi
push edi
push esi
call sub.advapi32.dll_CreateServiceW
test eax, eax
je 0x62540e
mov bl, 1
push eax
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625436
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret
Function at 0x625484
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x62552c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov edi, eax
test edi, edi
je 0x625511
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040a3d8
push eax
push edi
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x62550b
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x625505
call sub.KERNEL32.DLL_GetLastError_2
lea ecx, [ebp - 8]
xor edx, edx
call fcn.004277d4
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625533
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret

Function at 0x62553c
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409918
xor eax, eax
push ebp
push 0x6255df
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov edi, eax
test edi, edi
je 0x6255c9
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040a3d8
push eax
push edi
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x6255c3
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x1c
call fcn.0040748c
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x6255b7
push esi
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x6255bb
xor ebx, ebx
jmp 0x6255bd
mov bl, 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6255e6
lea eax, [ebp - 4]
call fcn.00409834
ret

Function at 0x6257a0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x62582c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x625838
push 0x62583c
lea edx, [ebp - 4]
mov eax, 0x62587c
call fcn.005fcec0
mov eax, dword [ebp - 4]
call fcn.0040a3d8
push eax
push 0x6258a0
push 0
call sub.shell32.dll_ShellExecuteW
push 0
push 0x625838
push 0x6258ac
lea edx, [ebp - 8]
mov eax, 0x6258f0
call fcn.005fcec0
mov eax, dword [ebp - 8]
call fcn.0040a3d8
push eax
push 0x6258a0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625833
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409894
ret