joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420d14
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x45bc95
call fcn.00440536
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.004210a4
call fcn.0040f752
push eax
lea ecx, [ebp - 0x94]
call fcn.0040dc5c
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040f758
mov ecx, eax
call fcn.0040e43a
test al, al
je 0x420e2e
push ebx
lea ecx, [ebp - 0x94]
call fcn.0040ded5
push edi
push 0x80
push 3
push edi
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.0040de91
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
cmp eax, 0xffffffff
jne 0x420d97
mov eax, str.Error_opening_file
jmp 0x420e0f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x420dac
mov eax, str.File_is_empty
jmp 0x420e0f
cmp edi, 0x400000
jbe 0x420dbb
mov eax, str.File_too_large
jmp 0x420e0f
and dword [ebp - 0x2c8], 0
push edi
call fcn.0043febf
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x420e17
push ebx
call fcn.0043feeb
pop ecx
mov ecx, esi
call fcn.004210a4
mov eax, str.Could_not_read_file
push 0
push eax
jmp 0x420f0e
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.00420f59
push dword [ebp - 0x2cc]
jmp 0x420f3c
call fcn.0040f758
push eax
lea ecx, [ebp - 0x94]
call fcn.0040deb8
call fcn.0040f808
test al, al
je 0x420e4f
call fcn.0040f75e
jmp 0x420e66
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0040de91
push eax
call fcn.0041d477
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x420e77
push eax
push str.Error_opening_zip_file
jmp 0x420f0e
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0041ceb7
add esp, 0x14
test eax, eax
je 0x420e9e
push 0
push str.Could_not_find_ziped_file
jmp 0x420f0e
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x420eb0
push ebx
push str.File_is_empty
jmp 0x420f0e
cmp ebx, 0x400000
jbe 0x420ec1
push 0
push str.File_too_large
jmp 0x420f0e
push ebx
call fcn.0043febf
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0041d84e
add esp, 0x18
test eax, eax
je 0x420f19
cmp eax, 0x600
je 0x420f19
push dword [ebp - 0x2c8]
call fcn.0043feeb
pop ecx
call fcn.0040f808
test al, al
jne 0x420f07
push edi
call fcn.0041cd13
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.004210cc
mov bl, al
jmp 0x420f44
call fcn.0040f808
test al, al
jne 0x420f29
push edi
call fcn.0041cd13
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.00420f59
push edi
mov bl, al
call fcn.0043feeb
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0040dd97
mov al, bl
call fcn.004404f1
ret 8
Function at 0x4287b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x4287e1
cmp eax, edi
jge 0x4287d5
push esi
call fcn.00426b51
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x428807
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4287ea
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x428821
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x428812
xor dl, dl
jmp 0x428817
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x428809
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x428856
push str.zlib_corrupt
call fcn.00426a0e
add esp, 4
jmp 0x428893
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x428866
push str.read_past_buffer
jmp 0x42884c
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x42887d
push edi
push esi
call fcn.00426a1d
pop ecx
pop ecx
test eax, eax
je 0x428893
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004416a0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x439a02
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x47a2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x439a6f
cmp dword [esi + 0x10], 0
je 0x439a6f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004404b0
mov ebx, esp
test ebx, ebx
je 0x439a6f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.0040de39
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004113f2
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe70
leave
ret 0x10

Function at 0x43c43b
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x45c977
call fcn.00440536
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x5b8], ebx
cmp dword [edi + 4], ebx
jne 0x43c4cd
lea eax, [ebp - 0xa8]
push eax
call fcn.0043c13a
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040de91
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.00412bd3
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00423407
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0040f4af
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0040e43a
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.0040dd97
mov esi, 0x5a8
test bl, bl
je 0x43c508
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.004404f1
ret 4
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x155210df
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x904304d8
mov ecx, 0x63117873
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5f7370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5f738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x620074
push ecx
mov edi, eax
call fcn.0060b198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5f73cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0060b02e
push esi
call fcn.0060afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x5fa850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x5fa8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x625720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5fa8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0060b1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x5fa8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x625720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5fa92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0060c082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x5fa957
mov word [eax], si
add eax, 2
push eax
call fcn.0060c030
add esp, 4
jmp 0x5fa959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x5fa8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x5fa8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x5faff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5fb080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x5fb0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x620458
push ecx
call fcn.0060b1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0060b1e1
add esp, 0x10
jmp 0x5fb0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0060b20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0060adff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.005fb050
mov eax, dword [0x625728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x5fb13b
push esi
call fcn.005fafb0
add esp, 4
mov dword [0x625728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x5fb14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.005faff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x5fe440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x5fe4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x5fe48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x5fe471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5fe47e
add edx, ecx
cmp ebx, edx
jb 0x5fe48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x5fe467
xor ecx, ecx
jmp 0x5fe4a2
test eax, eax
jne 0x5fe492
xor ecx, ecx
jmp 0x5fe4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.005fe3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x5fe8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5fe921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x5fe946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x5fe96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x5fe993
push ecx
push esi
call fcn.005fe4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x5ffc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x5ffc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x5ffc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x5ffc38
add edx, eax
cmp ebx, edx
jb 0x5ffc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x5ffc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x5ffc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x5ffc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x5ffcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x5ffc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5ffca8
add edx, ecx
cmp ebx, edx
jb 0x5ffcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x5ffc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x5fff60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0060c145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x5ffffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x5fffdd
lea eax, [esp + 0x18]
push eax
jmp 0x5fffe2
push 0x625720
call fcn.0060bfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x5fffb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x5fff40
push 4
push ecx
push eax
call fcn.0060c43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x600310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.0060c145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x6003ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x60038d
lea eax, [esp + 0x18]
push eax
jmp 0x600392
push 0x625720
call fcn.0060bfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x600360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x5fff40
push 4
push ecx
push eax
call fcn.0060c43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x601f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x601fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x601fcf
push ebx
push edi
push 0x625770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x601fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x625770
push esi
call ebx
test eax, eax
je 0x601fae
mov ebp, 3
cmp dword [0x625774], ebp
jne 0x601faa
push 0x3e8
call edi
push 0x625770
push esi
call ebx
test eax, eax
jne 0x601f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x601fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x601fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret
Function at 0x605e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x61b8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x605ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.006027a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x605e61
mov edx, dword [eax]
jmp 0x605e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00604050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x605ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x605ebf
cmp esi, edi
je 0x605ebf
mov ecx, esi
call fcn.005fda00
push esi
call fcn.0060b1c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.00602990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x605ef5
mov eax, dword [eax]
jmp 0x605ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.00601640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x605f25
mov eax, dword [eax]
jmp 0x605f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x605f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x605f76
cmp esi, edi
je 0x605f76
mov eax, dword [esi]
cmp eax, edi
je 0x605f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x605f6d
push eax
call fcn.0060b1c8
add esp, 4
push esi
call fcn.0060b1c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret