joyce8/EMBER2024-capa huggingface dataset:
Function at 0x511a50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x94], 0
jle 0x511b61
push ebx
lea edx, [edi + 0x48]
push esi
nop
mov esi, dword [edi + 0x98]
cmp esi, dword [edi + 0x9c]
je 0x511a90
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x98], eax
mov dword [eax + 0x30], 0
jmp 0x511aa8
test esi, esi
je 0x511ac0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
test esi, esi
je 0x511ac0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
dec dword [edi + 0x94]
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
sub dword [edi + 0x44], eax
lock xadd dword [edx], eax
mov eax, dword [edi + 0x8c]
xor ebx, ebx
push ebx
push esi
mov dword [esi + 0x34], eax
lea eax, [ebp + 8]
push ebx
push eax
push 1
push ecx
push dword [esi + 0x34]
mov dword [ebp + 8], ebx
mov dword [esi + 0x18], 3
mov dword [esi + 0x28], 2
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x511b09
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
or eax, 0xffffffff
lea ecx, [esi + 0x28]
lock xadd dword [ecx], eax
dec eax
je 0x511b22
test ebx, ebx
je 0x511b46
cmp ebx, 0x3e5
je 0x511b42
mov ecx, dword [ebp - 4]
push esi
lea ecx, [ecx + 0x9c]
call fcn.0050e270
test eax, eax
jne 0x511b42
push esi
push eax
mov eax, dword [esi + 0x14]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x511b56
cmp dword [edi + 0x94], 0
lea edx, [edi + 0x48]
jg 0x511a70
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x512930
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 8], ecx
test ecx, ecx
jne 0x512972
call fcn.0050d9f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 8]
push 0
push eax
mov dword [edi + 0x10], 0
push dword [edi + 0x10]
mov dword [edi + 0x14], 0
push dword [edi + 0x14]
mov dword [edi + 4], eax
push 4
push ecx
mov dword [edi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi], eax
test eax, eax
jne 0x5129c6
call fcn.0050d9f0
push dword [edi + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x512d30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
mov eax, dword [esi + 4]
test eax, eax
je 0x512d4d
sub esp, 0x18
push ecx
mov ecx, eax
call fcn.00513020
jmp 0x512d66
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x512d79
call fcn.0050d9f0
test eax, eax
jns 0x512d7b
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x512d9b
call fcn.0050d9f0
test eax, eax
js 0x512dd1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x512da8
test eax, eax
je 0x512dc3
test ecx, ecx
ja 0x512dc3
jb 0x512db1
cmp eax, dword [ebp + 0xc]
ja 0x512dc3
mov ecx, dword [ebp + 8]
sub esp, 0x14
push dword [esi]
call fcn.00512930
pop esi
mov esp, ebp
pop ebp
ret
or eax, ecx
mov eax, 0x800703ee
je 0x512dd1
mov eax, 0x800700df
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x512e80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ecx + 0x8c]
push esi
xor esi, esi
mov dword [edx + 0x34], eax
push esi
push edx
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push 1
lea eax, [edx + 0x1c]
mov dword [edx + 0x18], 4
push eax
push dword [edx + 0x34]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x512ec5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x3e5
cmove esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x516b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004e9840
mov dword [ebp - 0x2c], 0x57b910
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp - 0x2c]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x516c22
xor eax, eax
mov word [ebp - 0x23c], ax
push 0x206
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.0054cf60
add esp, 0xc
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x1c]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004e9c60
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.004e9c60
push eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x516c77
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x516c77
lea ecx, [ebp - 0x1c]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004e9c60
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.004e9c60
push eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.004e99a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 8
Function at 0x516f70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57554d
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], 0
mov dword [ebp - 4], 1
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x238]
call fcn.004e9840
mov byte [ebp - 4], 2
mov dword [ebp - 0x244], 0x57bb00
lea ecx, [ebp - 0x23c]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp - 0x244]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x5170ea
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0054cf60
add esp, 0xc
mov dword [ebp - 0x220], 1
lea edx, [ebp - 0x21c]
push edx
push 0
lea eax, [ebp - 0x220]
push eax
push 0
lea ecx, [ebp + 0xc]
call fcn.004e9c60
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x517098
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0
lea ecx, [ebp + 0xc]
call fcn.004e9c60
push eax
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.004e99f0
jmp 0x5170db
lea ecx, [ebp + 0x24]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004e9c60
push eax
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x51715a
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x244]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x51715a
lea ecx, [ebp - 0x238]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004e9c60
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp + 8]
call fcn.004e98f0
mov ecx, dword [ebp - 0x248]
or ecx, 1
mov dword [ebp - 0x248], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.004e99a0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.004e99a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.004e99a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 0x34
Function at 0x5171c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x57bb70
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x51723d
lea ecx, [ebp + 0x20]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp + 0x20]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c60
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x517292
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x517292
lea ecx, [ebp + 0x20]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x20]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c60
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.004e99a0
lea ecx, [ebp + 0x20]
call fcn.004e99a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 0x30
Function at 0x5172c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57558d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004e38e0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004e9c60
push eax
push 0x57c4a0
lea ecx, [ebp - 0x28]
push ecx
call fcn.004e2110
add esp, 0xc
lea edx, [ebp - 0x44]
push edx
push 0x2001f
push 0
lea ecx, [ebp - 0x28]
call fcn.004e9c60
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x517384
lea ecx, [ebp + 0x20]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp + 0x20]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c60
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5173de
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.004e9c60
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x5173de
lea ecx, [ebp + 0x20]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp + 0x20]
call fcn.004e9c60
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004e9c60
push eax
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.004e99a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004e99a0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004e99a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.004e99a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 0x30
Function at 0x519fb0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x814], 0
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x810]
call fcn.0051e880
mov dword [ebp - 0x81c], eax
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x51a119
mov ecx, dword [ebp - 0x810]
call fcn.0051d950
test eax, eax
je 0x51a119
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x80c], 0
cmp dword [ebp - 0x818], 0
jne 0x51a03d
call fcn.0050d9f0
mov dword [ebp - 0x814], eax
jmp 0x51a10c
push 2
mov edx, dword [ebp - 0x810]
add edx, 0x2c
push edx
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x51a101
mov ecx, dword [ebp - 0x810]
add ecx, 0x2c
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 2
push 0x110
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0x400
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.0054cf60
add esp, 0xc
push 4
push 0
lea ecx, [ebp - 0x808]
push ecx
call fcn.0054cf60
add esp, 0xc
push 0x57cae0
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], eax
lea ecx, [ebp - 0x808]
push ecx
push 1
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51a10c
call fcn.0050d9f0
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x818]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x814]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 4
Function at 0x51a660
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575740
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x274]
test ecx, ecx
je 0x51a70a
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x78]
push eax
call fcn.004e3180
add esp, 4
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
call fcn.004e9c60
push eax
push str.__s____s
lea edx, [ebp - 0x28]
push edx
call fcn.004e2110
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.004e99a0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
lea eax, [ebp - 0x28]
push eax
call fcn.004e9840
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x4c]
call fcn.0051ab60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004e99a0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x51a724
jmp 0x51a795
push 0xf01ff
mov ecx, dword [ebp - 0x4c]
add ecx, 0x2c
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x51a74f
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51a795
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x51a763
jmp 0x51a795
cmp dword [ebp - 0x40], 1
jne 0x51a781
push 0
push 0
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 4
mov ecx, dword [ebp - 0x4c]
call fcn.0051fc70
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 4
Function at 0x51a7b0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x51a7e0
jmp 0x51a864
push 0xf01ff
mov eax, dword [ebp - 0x30]
add eax, 0x2c
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x51a80b
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51a864
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x51a833
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51a864
cmp dword [ebp - 0x1c], 1
jne 0x51a850
mov dword [ebp - 0x24], 0x57cd78
lea ecx, [ebp - 0x24]
push ecx
push 1
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret

Function at 0x51a880
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x51a8b0
jmp 0x51a94a
push 0xf01ff
mov eax, dword [ebp - 0x24]
add eax, 0x2c
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x51a8db
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51a94a
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x51a8ef
jmp 0x51a94a
cmp dword [ebp - 0x1c], 4
jne 0x51a940
push 0x20
mov ecx, dword [ebp - 0x24]
call fcn.0051fc70
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x26c], 0
je 0x51a936
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x26c]
cmp dword [ecx + 4], 0
je 0x51a936
push 0
push 0
push 0x4ca
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x26c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret
Function at 0x51a960
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575796
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
lea eax, [ebp - 0xa4]
push eax
call fcn.004e2f40
add esp, 4
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x64]
call fcn.004e9c60
push eax
push str._sadsconfig.ini
lea edx, [ebp - 0x28]
push edx
call fcn.004e2110
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.004e99a0
lea eax, [ebp - 0x8c]
push eax
call fcn.004e3300
add esp, 4
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x70], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x70]
call fcn.004e9c60
push eax
push 0x57cda0
lea edx, [ebp - 0x40]
push edx
call fcn.004e2110
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c]
call fcn.004e99a0
lea eax, [ebp - 0xbc]
push eax
call fcn.004e34e0
add esp, 4
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x6c]
call fcn.004e9c60
push eax
push 0x57cdf8
lea edx, [ebp - 0x58]
push edx
call fcn.004e2110
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbc]
call fcn.004e99a0
lea ecx, [ebp - 0x28]
call fcn.004e9c60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x40]
call fcn.004e9c60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
call fcn.004e9c60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x58]
call fcn.004e99a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.004e99a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004e99a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret

Function at 0x51ab60
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5e56f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], str.SYSTEMCurrentControlSet_servicesFlash_Helper_Service
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x51abd7
lea ecx, [ebp + 8]
call fcn.004e9290
shl eax, 1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp + 8]
call fcn.004e9c60
push eax
push 1
push 0
push str.ImagePath
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.004e99a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054caf9
mov esp, ebp
pop ebp
ret 0x18