joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fc7cb
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Uninstalling_all_devices_not_present...
push 0xffffffffffffffff
call fcn.0057b610
push ecx
mov ecx, edi
call fcn.0057c7a0
push 1
mov ecx, edi
mov esi, eax
call fcn.00554030
mov eax, dword [edi + 0xcc]
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 0x4c]
add eax, 4
mov byte [ebp - 0x11], 0
push 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x11]
push 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push eax
push 0x57cfa0
push 0
push 0
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x3c], esi
xor edx, edx
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.005cca30
test al, al
je 0x5765f5
nop dword [eax]
mov eax, dword [edi + 0x4c]
cmp byte [eax + 5], 0
je 0x5765dd
mov byte [eax + 4], 1
push 0
push 0
mov ecx, edi
call fcn.005494d0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x5765d0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.005db290
cmp dword [ebp - 0x24], 1
mov ecx, str._devices
mov eax, str._device
cmovne eax, ecx
lea ecx, [ebp - 0x20]
push str._were_uninstalled
push eax
call fcn.005dc190
push eax
push str.Reset_all_devices_not_present_result:
mov ecx, edi
call fcn.0057b7e0
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.005dc430
cmp esi, 0xffffffff
je 0x576674
test esi, esi
je 0x576674
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x576fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fc8c9
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.Creating_a_driver_backup_of_all_devices...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
ret
push ebp
push es
add byte [edx], ch
push 0
push 0x62439c
push 0x624388
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.005da270
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x577078
xor edx, edx
lea ecx, [ebp - 0x20]
call fcn.005cf7e0
sub esp, 0xc
mov ecx, edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Driver_backup_
sub esp, 8
call fcn.0057c4e0
add esp, 4
lea ecx, [ebp - 0x20]
push eax
call fcn.005da510
push 1
mov ecx, edi
call fcn.00554030
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
call fcn.005dc190
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 0x4c]
push 0
add eax, 4
mov dword [ebp - 0x34], 0
push 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x44]
push eax
push 0x57d830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x48], esi
xor edx, edx
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.005cca30
test al, al
je 0x577105
nop
mov eax, dword [edi + 0x4c]
cmp byte [eax + 5], 0
je 0x5770ed
mov byte [eax + 4], 1
push 0
push 0
mov ecx, edi
call fcn.005494d0
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x5770e0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [edi + 0x4c]
cmp byte [eax + 4], 0
je 0x577125
or ebx, 0xffffffff
jmp 0x577191
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
test eax, eax
push eax
sete bl
call fcn.005db290
cmp dword [ebp - 0x30], 0
lea ecx, [ebp - 0x20]
jne 0x577153
mov dword [ebp - 0x4c], str.Failed_to_backup_drivers_to
call fcn.005dc190
xor ecx, ecx
xor edx, edx
jmp 0x577184
call fcn.005dc190
cmp dword [ebp - 0x30], 1
mov ecx, str._drivers_to
mov dword [ebp - 0x54], eax
mov eax, str._driver_to
cmovne eax, ecx
mov dword [ebp - 0x4c], str.Successfully_backed_up
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x50], eax
call fcn.005dc190
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
push edx
push ecx
push eax
push dword [ebp - 0x4c]
mov ecx, edi
call fcn.0057b7e0
cmp esi, 0xffffffff
je 0x5771a1
test esi, esi
je 0x5771a1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5778b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fc9e9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xe8], 0
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
jne 0x5778f9
xor eax, eax
jmp 0x5779a6
push 0x12c
push 2
sub esp, 0xc
push 0
push esi
push str.Uncompressing_archive:_r_n
call fcn.005779e0
push dword [ebp - 0x18]
push ecx
mov ecx, dword [edi + 0xe8]
push ebx
call fcn.005dc190
mov edx, esi
mov ecx, eax
call fcn.0059f440
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
xor edx, edx
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.005cca30
test al, al
je 0x57796c
nop dword [eax]
push 0
push 0
mov ecx, edi
call fcn.005494d0
test eax, eax
jne 0x5779c4
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x577950
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x57798d
push eax
push ebx
push 5
push 2
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
test eax, eax
sete bl
cmp esi, 0xffffffff
je 0x5779a4
test esi, esi
je 0x5779a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0x10
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or ebx, 0xffffffff
jmp 0x577994

Function at 0x5787a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x5787ef
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x5787ef
cmp dword [ebp - 8], 0x103
jne 0x5787ef
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
push ecx
mov ecx, esi
call fcn.0057c7a0
test eax, eax
jne 0x578821
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x57880e
call fcn.005b6bd0
test eax, eax
jne 0x578821
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
push edi
push 0
push 0
push eax
push 0x5c6c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esi + 0xd4]
cmp eax, 0xffffffff
je 0x57884e
test eax, eax
je 0x57884e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xd4], edi
test edi, edi
jne 0x578876
mov dword [esi + 0xd4], 0xffffffff
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xffffffff
je 0x578862
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x57bbe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0xb4]
test ecx, ecx
jne 0x57bc43
push 0xc
call fcn.0041e3d6
add esp, 4
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.005dc5e0
push 0
push 0
push 0x400
mov ecx, eax
mov dword [esi + 0xb4], eax
call fcn.005db9a0
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
mov ecx, dword [esi + 0xb4]
call fcn.005da0a0
mov ecx, eax
call fcn.005dc190
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x57cb00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd0e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70f200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.005d8790
movsd qword [esi], xmm0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xd4], 0xffffffff
mov dword [ebp - 4], 0
mov dword [esi + 0xd8], 0xffffffff
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [esi + 0xdc], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer
mov dword [esi + 0x100], str.HKLM64SOFTWARECarifredUVK___Ultra_Virus_Killer_backups
mov dword [esi + 0x108], 0
mov byte [esi + 0x10c], 0
call fcn.005e17c0
mov byte [esi + 0x105], al
test al, al
jne 0x57cd22
call fcn.005e17a0
test al, al
je 0x57cd24
mov al, 1
push ecx
mov ecx, esi
mov byte [esi + 0x48], al
mov byte [esi + 0x104], al
call fcn.0057c5d0
push ecx
mov ecx, esi
mov dword [esi + 0x40], eax
call fcn.0057c540
push ecx
mov ecx, esi
mov dword [esi + 0x44], eax
call fcn.0057c4e0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57ee00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd30e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x57ee65
sub esp, 8
lea ecx, [edi + 0x6c8]
push 0
push 0xffffffffffffffb0
sub esp, 8
push 0x3c
push 0x190
push dword [edi]
push str.Scanning_for_hardware_changes...
call fcn.005b6bf0
mov ecx, eax
call fcn.005b66e0
mov ecx, eax
call fcn.005b62b0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x410]
push 0
push 0
push ecx
push 0x57dc60
mov dword [ecx], 0
push 0
mov dword [ecx + 4], eax
push 0
mov dword [ecx + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x18], esi
xor edx, edx
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.005cca30
test al, al
je 0x57eec9
push 0
mov ecx, edi
call fcn.00580e20
xor edx, edx
mov ecx, esi
call fcn.005cca30
test al, al
jne 0x57eeb3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test bl, bl
jne 0x57eeea
lea ecx, [edi + 0x6c8]
call fcn.005b6b30
cmp dword [ebp - 0x14], 0
setne bl
cmp esi, 0xffffffff
je 0x57ef01
test esi, esi
je 0x57ef01
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x58bf80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fdfe5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x61e770
push 1
push 0
push 0x61e780
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x58c09c
cmp dword [ebp - 0x14], 0
je 0x58c09c
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0
call fcn.00401a90
mov dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x58bffd
mov edx, dword [edx]
jmp 0x58bfff
xor edx, edx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x18]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x58c072
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x58c06b
test esi, esi
je 0x58c06b
mov eax, dword [esi]
test eax, eax
je 0x58c049
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x58c060
push eax
call fcn.0041e1c3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0041e7c1
add esp, 8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x58c09e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x18]
jmp 0x58c09e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x58c540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe15c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
call fcn.005d8c40
mov esi, eax
test esi, esi
jne 0x58c587
xor edx, edx
jmp 0x58c73a
mov eax, 0xff
mov dword [ebp - 0x240], 0x64
cmp esi, 0x100
mov dword [ebp - 0x23c], 0xc
xorps xmm0, xmm0
cmovge esi, eax
movlpd qword [ebp - 0x238], xmm0
lea eax, [esi + 1]
push eax
push ecx
lea eax, [ebp - 0x230]
push 0x100
push eax
call fcn.00421833
add esp, 0x10
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov word [ebp + esi*2 - 0x230], ax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], eax
xorps xmm0, xmm0
push 0
lea eax, [ebp - 0x240]
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x2c]
push 0xffffffffffffffff
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [ebp - 0x24c], eax
call fcn.005d6a80
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push str.SystemRestorePointCreationFrequency
lea ecx, [ebp - 0x14]
call fcn.005d66b0
test al, al
je 0x58c658
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
je 0x58c658
push 0
lea eax, [ebp - 0x20]
mov byte [ebp - 0x251], 1
push eax
push 4
push str.SystemRestorePointCreationFrequency
lea ecx, [ebp - 0x14]
call fcn.005d5f20
jmp 0x58c65f
mov byte [ebp - 0x251], 0
push 0
push 0
lea eax, [ebp - 0x250]
push eax
push 0x58c490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmove esi, eax
mov dword [ebp - 0x244], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x58c707
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call edi
test eax, eax
je 0x58c6cf
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
nop
cmp dword [ebp - 0x18], 0x103
jne 0x58c6cf
call fcn.005d8ff0
push 1
push 0x14
call ebx
lea eax, [ebp - 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x58c6b0
cmp byte [ebp - 0x251], 0
lea ecx, [ebp - 0x14]
je 0x58c6ef
push 0
lea eax, [ebp - 0x1c]
push eax
push 4
push str.SystemRestorePointCreationFrequency
call fcn.005d5f20
jmp 0x58c6f9
push str.SystemRestorePointCreationFrequency
call fcn.005d5df0
cmp dword [ebp - 0x18], 0
je 0x58c707
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
jmp 0x58c71e
xorps xmm0, xmm0
movlpd qword [ebp - 0x248], xmm0
mov ebx, dword [ebp - 0x244]
mov edi, dword [ebp - 0x248]
cmp esi, 0xffffffff
je 0x58c72e
test esi, esi
je 0x58c72e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.005d69e0
mov eax, edi
mov edx, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x58f340
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fe57c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
mov al, byte [ebx + 8]
mov edi, str.GoogleChromeUser_DataLast_Browser
mov byte [ebp - 0x41], al
xorps xmm0, xmm0
cmp byte [ebp - 0x41], 0
mov eax, str.MicrosoftEdgeUser_DataLast_Browser
mov esi, dword [ebx + 0xc]
cmove eax, edi
movq qword [ebp - 0x20], xmm0
sub esp, 8
mov dword [ebp - 0x18], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push edx
push ecx
lea ecx, [ebp - 0x20]
call fcn.005dc520
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.005dc190
mov dl, 1
mov ecx, eax
call fcn.005e3540
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push 0
push eax
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x40]
call fcn.005e4770
push 0
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.005e3f60
test eax, eax
je 0x58f429
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x58f4cd
cmp byte [ebp - 0x41], 0
mov eax, str.GoogleChromeApplicationchrome.exe
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edi, str.MicrosoftEdgeApplicationmsedge.exe
mov ecx, esi
cmove edi, eax
push edi
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.005dc200
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x58f4cd
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
push eax
push 0x26
mov ecx, esi
call fcn.005dbbc0
mov ecx, eax
call fcn.005da780
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x58f4cd
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
push eax
push 0x2a
mov ecx, esi
call fcn.005dbbc0
mov ecx, eax
call fcn.005da780
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x41], al
jmp 0x58f4d1
mov byte [ebp - 0x41], 1
lea ecx, [ebp - 0x38]
call fcn.005d9280
mov eax, dword [ebp - 0x40]
cmp eax, 0xffffffff
je 0x58f4ec
test eax, eax
je 0x58f4ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20]
call fcn.005dc430
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x58f720
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov esi, edx
movsd qword [ebp - 0xc], xmm3
push esi
mov edi, ecx
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
mov eax, dword [ebp + 8]
setne bl
cmp eax, 0xffffffff
je 0x58f787
cmp esi, 2
jne 0x58f787
movsd xmm0, qword [ebp - 0xc]
comisd xmm0, xmmword [0x6edab8]
jb 0x58f787
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4

Function at 0x58feb0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
mov ebx, ecx
xorps xmm0, xmm0
push 0x10
push ebx
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 1
lea ecx, [ebp - 0x38]
call fcn.005d0610
xorps xmm1, xmm1
lea ecx, [ebp - 0x38]
call fcn.005d05a0
movsd xmm1, qword [0x6edbd8]
comisd xmm1, xmm0
jbe 0x58ff4b
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
je 0x58ff76
push 0x14
call esi
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
test eax, eax
je 0x58ff4b
call fcn.005d8ff0
test al, al
jne 0x58ff60
xorps xmm1, xmm1
lea ecx, [ebp - 0x38]
call fcn.005d05a0
movsd xmm1, qword [0x6edbd8]
comisd xmm1, xmm0
ja 0x58ff14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8