joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51e0b0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc58
push ebx
xor edx, edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x51e27b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x51e259
mov dl, 1
mov eax, dword [0x43b044]
call fcn.00449524
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004073f8
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x51e242
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.0049d364
test al, al
je 0x51e236
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 0x3a0], 0
lea ecx, [ebp - 0x3a4]
mov edx, 0x51e28c
lea eax, [ebp - 0x39c]
call fcn.0041fda4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x51e236
xor eax, eax
push ebp
push 0x51e22f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x200
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x51e2fc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x51e218
lea eax, [ebp - 0x3a8]
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408048
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x51e218
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e236
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x51e125
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dl, 1
call fcn.00449460
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51e282
lea eax, [ebp - 0x3a8]
call fcn.004073f8
ret
Function at 0x51f0d4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x550310]
cmp byte [eax + 0xb1], 0
jne 0x51f14c
cmp dword [0x550330], 0
jne 0x51f109
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x54a5c0]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x550330], eax
cmp dword [0x55032c], 0
jne 0x51f124
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x55032c], eax
cmp dword [0x550334], 0
jne 0x51f14c
lea eax, [ebp - 4]
push eax
push 0
push 0
mov eax, dword [0x54a5bc]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x550334], eax
pop ecx
pop ebp
ret

Function at 0x51f24c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.0051f1e4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x51f26d
xor eax, eax
call fcn.0051f21c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x51f287
mov al, 1
call fcn.0051f21c
mov esp, ebp
pop ebp
ret

Function at 0x51feac
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x178], 0
je 0x51ff8e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x98], 0
jne 0x51ff85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x51fdac
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
cmp dword [eax + 8], 0
je 0x51ff85
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xffffffec
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x20], eax
test byte [ebp - 0x20], 8
je 0x51ff3f
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x51ff85
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00444ef8
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x51ff54
mov eax, dword [ebp - 4]
inc dword [eax + 0x98]
mov esp, ebp
pop ebp
Function at 0x520258
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x550310]
cmp dword [eax + 0x178], 0
je 0x520419
cmp byte [ebp - 5], 0
jne 0x52033b
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x52032d
mov eax, dword [ebp - 4]
call fcn.00523ae8
push eax
push 0x520144
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x5202f0
mov eax, dword [0x550310]
cmp byte [eax + 0xd7], 0
je 0x5202f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00409124
cmp eax, 0
jl 0x5202f0
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5202d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x52032d
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00444ef8
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x520305
mov eax, dword [ebp - 4]
inc dword [eax + 0xa0]
jmp 0x520419
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jle 0x520419
mov eax, dword [ebp - 4]
dec dword [eax + 0xa0]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xa0], 0
jne 0x520419
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x5203b1
mov eax, dword [0x550310]
cmp byte [eax + 0xd7], 0
je 0x5203b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
call fcn.00409124
cmp eax, 0
jl 0x5203b1
mov dword [ebp - 0xc], eax
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
push eax
call sub.user32.dll_ShowWindow
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x520391
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x5203ee
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00444ef8
push eax
call sub.user32.dll_ShowOwnedPopups
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x5203c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, dword [ebp - 4]
add eax, 0xdc
mov ecx, 1
mov edx, dword [0x50f39c]
call fcn.004092d0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x521244
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xb0], 0
je 0x5212ce
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd7], 0
jne 0x5212ce
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 8]
call fcn.00407580
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5212b5
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5212df
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004077d8
jmp 0x5212df
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x90]
call fcn.004077d8
mov esp, ebp
pop ebp
ret

Function at 0x5230a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x88], 0
je 0x52312e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00495d00
test al, al
je 0x52312e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00495768
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x52312e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x52311e
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00495768
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
call fcn.00489ca0
jmp 0x52312e
mov cl, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 4]
call fcn.00522e6c
pop ecx
pop ebp
ret
Function at 0x5288f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x8c], 0
jne 0x528997
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00495768
mov ecx, eax
mov dl, 1
mov eax, dword [0x4a3624]
call fcn.0048e510
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004a8c10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2a4], eax
mov dword [edx + 0x2a0], 0x528140
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00495768
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
call fcn.00495768
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c], 0
jne 0x528a31
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00495768
mov ecx, eax
mov dl, 1
mov eax, dword [0x4a3624]
call fcn.0048e510
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004a8c10
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [eax + 0x2a4], edx
mov dword [eax + 0x2a0], 0x5281b0
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00495768
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00495768
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x528ab7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00495768
mov ecx, eax
mov dl, 1
mov eax, dword [0x4a4060]
call fcn.0048e510
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00495768
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00495768
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret

Function at 0x52bfc8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x114], 6
setae byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x52e49c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004074dc
mov eax, dword [ebp - 8]
call fcn.004074dc
xor eax, eax
push ebp
push 0x52e6af
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 5
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041f640
test al, al
je 0x52e685
xor eax, eax
push ebp
push 0x52e679
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0x10], 0
je 0x52e59d
lea eax, [ebp - 0x49]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404f58
xor eax, eax
mov dword [ebp - 0x41], eax
mov dword [ebp - 0x49], 0x3c
mov eax, dword [ebp - 4]
call fcn.00407fb4
mov dword [ebp - 0x39], eax
mov eax, dword [ebp - 8]
call fcn.00407fb4
mov dword [ebp - 0x35], eax
mov eax, 0x52e6c4
mov dword [ebp - 0x3d], eax
cmp byte [ebp + 0x14], 0
je 0x52e549
xor eax, eax
mov dword [ebp - 0x2d], eax
lea eax, [ebp - 0x49]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x52e66f
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0xc], 0
je 0x52e66f
cmp dword [ebp - 0x11], 0
je 0x52e66f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x11]
mov dword [eax], edx
cmp byte [ebp + 0xc], 0
je 0x52e66f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x11]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x11]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x52e66f
lea eax, [ebp - 0x90]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f58
imul ebp, ebp, 0x7085c7ff
invalid
invalid
inc dword [eax + eax]
add byte [eax + 0x7400147d], al
invalid
mov dword [ebp - 0x64], 1
mov word [ebp - 0x60], 0
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0x52e6dc
push dword [ebp - 4]
push 0x52e6ec
push dword [ebp - 8]
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.00408280
mov eax, dword [ebp - 0xa4]
call fcn.00407fb4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x52e66b
mov byte [ebp - 0xd], 0
cmp byte [ebp + 0xc], 0
je 0x52e650
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa0]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0xa0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x9c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 8], 0
je 0x52e66f
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xa0]
mov ecx, 0x10
call fcn.004046f0
jmp 0x52e66f
mov byte [ebp - 0xd], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52e689
mov byte [ebp - 0xd], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52e6b6
lea eax, [ebp - 0xa4]
call fcn.004073f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407458
ret
Function at 0x530b00
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004074dc
mov eax, dword [ebp - 8]
call fcn.004074dc
xor eax, eax
push ebp
push 0x530c78
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x530c2b
xor eax, eax
push ebp
push 0x530c16
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, dword [ebp - 4]
call fcn.00407fb4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x530be7
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00407fb4
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 9], al
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x20]
call fcn.0042341c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x530c98
call fcn.004081f8
mov eax, dword [ebp - 0x1c]
call fcn.0052c604
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x530c0c
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x28]
call fcn.0042341c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x530cd8
call fcn.004081f8
mov eax, dword [ebp - 0x24]
call fcn.0052c604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x530c20
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x530c50
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x30]
call fcn.0042341c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x530d24
call fcn.004081f8
mov eax, dword [ebp - 0x2c]
call fcn.0052c604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530c7f
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00407458
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407458
ret
Function at 0x532900
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x532908
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x532b77
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov al, byte [ebp - 1]
sub al, 2
jae 0x532b4c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x78]
mov edx, 0x532b94
call fcn.004081f8
mov eax, dword [ebp - 0x78]
call fcn.0052c604
cmp byte [ebp - 1], 0
jne 0x532973
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x7c]
mov edx, 0x532bcc
call fcn.004081f8
mov eax, dword [ebp - 0x7c]
call fcn.0052c604
jmp 0x53298e
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x80]
mov edx, 0x532c04
call fcn.004081f8
mov eax, dword [ebp - 0x80]
call fcn.0052c604
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x5329ad
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x10]
mov edx, dword [0x5503b8]
call fcn.004081f8
jmp 0x5329cb
mov eax, dword [ebp - 8]
push dword [eax + 0xc]
push 0x532c38
mov eax, dword [ebp - 8]
push dword [eax + 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408280
cmp byte [ebp - 1], 1
jne 0x5329e0
lea eax, [ebp - 0x14]
mov edx, 0x532c48
call fcn.00407820
jmp 0x5329ed
lea eax, [ebp - 0x14]
mov edx, 0x532c78
call fcn.00407820
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0041f640
test al, al
je 0x532b2e
xor eax, eax
push ebp
push 0x532ae4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f58
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0x532cac
push dword [ebp - 0x14]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00408280
mov eax, dword [ebp - 0x84]
call fcn.00407fb4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x532a9c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 9], 1
jmp 0x532ada
push 0x532cbc
push dword [ebp - 0x10]
push 0x532cac
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x8c]
call fcn.0042341c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
mov edx, 4
call fcn.00408280
mov eax, dword [ebp - 0x88]
call fcn.0052c604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x532b4c
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x10]
mov edx, 0x532d4c
call fcn.004081f8
mov eax, dword [ebp - 0x98]
call fcn.0052c604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532b7e
lea eax, [ebp - 0x98]
mov edx, 9
call fcn.00407458
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407458
ret
Function at 0x5358b8
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5359c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004073f8
mov dl, 1
mov eax, dword [0x45acd4]
call fcn.0045be20
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x53598e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0045bf08
mov edx, 0x5359dc
mov eax, dword [ebp - 8]
call fcn.0045d334
test al, al
je 0x53596e
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov edx, 0x5359dc
mov eax, dword [ebp - 8]
call fcn.0045c194
test al, al
je 0x535947
mov ecx, dword [ebp - 4]
mov edx, 0x535a54
mov eax, dword [ebp - 8]
call fcn.0045ca1c
jmp 0x535978
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x18]
call fcn.0042341c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x535a6c
call fcn.004081f8
mov eax, dword [ebp - 0x14]
call fcn.0052c604
jmp 0x535978
mov eax, 0x535acc
call fcn.0052c604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x535995
mov eax, dword [ebp - 8]
call fcn.004057ac
ret