joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441c32
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push 0x18
mov eax, 0x5b9a73
call fcn.00580b7e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.0040852d
mov byte [ebp - 4], 1
push 0x67b920
xor ecx, ecx
lea esi, [ebp - 0x18]
call fcn.00426092
cmp eax, 0xffffffff
je 0x441c8c
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
push ecx
mov ecx, eax
call fcn.004262df
mov byte [ebp - 4], 2
mov edi, esi
call fcn.00408591
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0040856e
push dword [ebp + 0x24]
lea eax, [ebp - 0x1c]
push eax
call fcn.0040852d
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
call fcn.00426126
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x18]
call fcn.00424799
pop ecx
test al, al
jne 0x441dc1
mov eax, esi
push eax
call fcn.004207c3
pop ecx
test al, al
je 0x441cd4
mov eax, esi
push eax
call fcn.0042082e
pop ecx
jmp 0x441dc1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x441d06
test al, 0x10
je 0x441d06
mov byte [ebp - 0x12], bl
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 0x12]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.0045980d
add esp, 0x14
jmp 0x441dc1
push 1
lea esi, [ebp - 0x1c]
call fcn.004087a8
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00408187
mov byte [ebp - 4], 4
lea esi, [ebp - 0x18]
call fcn.004087a8
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00408187
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
call fcn.0045310a
add esp, 0x3c
mov byte [ebp - 0x11], bl
push 0x67b924
lea eax, [ebp - 0x20]
push eax
call fcn.0040852d
mov byte [ebp - 4], 6
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
call fcn.004707b0
mov byte [ebp - 0x12], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.0040856e
cmp byte [ebp - 0x12], bl
je 0x441d9c
lea eax, [ebp - 0x11]
push eax
push 1
push ebx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040fb09
lea ecx, [ebp - 0x20]
call fcn.0040842d
cmp byte [ebp - 0x11], bl
jne 0x441da5
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x67b92c
lea eax, [ebp - 0x1c]
push eax
call fcn.0040860e
test eax, eax
jne 0x441dc1
mov ebx, dword [ebp - 0x18]
call fcn.0041f8e0
xor ebx, ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040856e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 0x24
Function at 0x442cf5
Capabilities:
Delete file

Disassembly:
push 0x48
mov eax, 0x5bdd04
call fcn.00580bea
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x1c]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push eax
call fcn.0040852d
mov byte [ebp - 4], 1
push dword [ebp - 0x4c]
lea eax, [ebp - 0x38]
push eax
call fcn.0040852d
mov byte [ebp - 4], 2
cmp dword [ebp + 0x34], ebx
jne 0x442d9c
push 1
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x40], esp
push dword [ebp - 0x3c]
call fcn.00408187
mov byte [ebp - 4], 3
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x38]
call fcn.00408187
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.0045310a
add esp, 0x3c
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x67ba78
lea eax, [ebp - 0x3c]
push eax
call fcn.0040860e
test eax, eax
jne 0x442dc0
mov ebx, dword [ebp - 0x38]
call fcn.0041f8e0
xor ebx, ebx
jmp 0x442dc0
cmp dword [ebp + 0x34], 1
jne 0x442dab
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442dc0
cmp dword [ebp + 0x34], 2
jne 0x442dc0
call fcn.00455f7a
lea edx, [ebp - 0x38]
mov ecx, eax
call fcn.00462a95
lea eax, [ebp - 0x34]
push eax
call fcn.0040f7de
mov byte [ebp - 4], 5
push ebx
lea ecx, [ebp - 0x34]
call fcn.004100b3
test al, al
je 0x442de7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00411d89
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
push eax
call fcn.0040f80a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.0040856e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c46
ret 0x34
Function at 0x442e23
Capabilities:
Delete file

Disassembly:
push 0x80
mov eax, 0x5bdcb2
call fcn.00580bea
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
call fcn.00413cf5
mov byte [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
call fcn.00413cf5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x88]
push eax
call fcn.00413cf5
mov byte [ebp - 4], 3
lea eax, [ebp - 0x6c]
push eax
lea esi, [ebp + 0xc]
call fcn.00420341
lea eax, [ebp - 0x54]
push eax
lea esi, [ebp + 0x1c]
call fcn.00420341
lea eax, [ebp - 0x88]
push eax
lea esi, [ebp + 0x2c]
call fcn.0042055c
add esp, 0xc
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 2
cmp edi, eax
jae 0x442f7c
lea esi, [ebp - 0x88]
call fcn.004138a1
cmp dword [eax], 0
jne 0x442f34
push 1
lea esi, [ebp - 0x6c]
call fcn.004138a1
mov eax, dword [eax]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x8c], esp
push eax
call fcn.00408187
mov byte [ebp - 4], 4
lea esi, [ebp - 0x54]
call fcn.004138a1
mov eax, dword [eax]
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.00408187
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
call fcn.0045310a
add esp, 0x3c
lea esi, [ebp - 0x54]
call fcn.004138a1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Lnk.Suspicious.Reputation
lea esi, [ebp - 0x6c]
call fcn.004138a1
push eax
call fcn.0040860e
test eax, eax
jne 0x442f76
lea esi, [ebp - 0x54]
call fcn.004138a1
mov ebx, dword [eax]
call fcn.0041f8e0
jmp 0x442f76
lea esi, [ebp - 0x88]
call fcn.004138a1
cmp dword [eax], 1
jne 0x442f4e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x442f76
lea esi, [ebp - 0x88]
call fcn.004138a1
cmp dword [eax], 2
jne 0x442f76
call fcn.00455f7a
mov ebx, eax
lea esi, [ebp - 0x54]
call fcn.004138a1
mov edx, eax
mov ecx, ebx
call fcn.00462a95
inc edi
jmp 0x442e8b
lea eax, [ebp - 0x34]
push eax
call fcn.0040f7de
mov byte [ebp - 4], 6
xor edi, edi
push edi
lea ecx, [ebp - 0x34]
call fcn.004100b3
test al, al
je 0x442fbd
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
sar eax, 2
cmp edi, eax
jae 0x442fbd
lea esi, [ebp - 0x6c]
call fcn.004138a1
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00411d89
inc edi
jmp 0x442f98
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
push eax
call fcn.0040f80a
mov byte [ebp - 4], 2
lea eax, [ebp - 0x88]
push eax
call fcn.0043c1cc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x6c]
push eax
call fcn.00413877
mov byte [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
call fcn.00413877
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c46
ret 0x34
Function at 0x44300c
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x5a7dd1
call fcn.00580b7e
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], 1
jne 0x443061
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
push ebx
lea esi, [ebp - 0x14]
call fcn.00409508
push eax
push ebx
push 0x20006
push 1
push ebx
push ebx
push 0x67bae0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], ebx
je 0x443071
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x443071
push 0x67bb1c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 0x14
Function at 0x444cfc
Capabilities:
Delete file
Set file attributes

Disassembly:
push 8
mov eax, 0x5b0a7b
call fcn.00580b7e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0040852d
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
call fcn.0040877f
mov esi, dword [ebp - 0x14]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x444d4e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040856e
xor eax, eax
jmp 0x444d62
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
mov eax, 0x80004005
call fcn.00580c23
ret 0x14
Function at 0x4461c8
Capabilities:
Terminate process

Disassembly:
push 4
mov eax, 0x5a57a2
call fcn.00580b7e
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebp + 0x14]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x4461fa
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 0x14

Function at 0x446257
Capabilities:
Copy file

Disassembly:
push 0xc
mov eax, 0x5b0a35
call fcn.00580b7e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x24]
lea eax, [ebp - 0x18]
push eax
call fcn.0040852d
mov esi, eax
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0040852d
mov byte [ebp - 4], 2
mov esi, dword [esi]
mov eax, dword [eax]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0040856e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 0x24

Function at 0x446847
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xc
mov eax, 0x5ad9af
call fcn.00580b7e
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x5c
mov esi, dword [ebp + 8]
call fcn.004260df
mov esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.004084d7
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x4468c6
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.004262df
mov byte [ebp - 4], 2
lea edi, [ebp - 0x14]
call fcn.00408591
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040856e
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
je 0x4468c6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4468c6
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
mov esi, edi
call fcn.004260df
mov esi, eax
jmp 0x446871
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
call fcn.00580c23
ret
Function at 0x447bb9
Capabilities:
Shutdown system

Disassembly:
push 0x18
mov eax, 0x5a576c
call fcn.00580b7e
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x447be8
mov eax, 0x80004005
jmp 0x447c34
lea eax, [ebp - 0x20]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x447c32
push 0x80020013
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 4
Function at 0x448580
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x5be17a
call fcn.00580b7e
xor esi, esi
mov dword [ebp - 4], esi
push dword [0x6d6e5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
push esi
push esi
push 0x4404ba
push esi
push esi
call fcn.005752ab
add esp, 0x18
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00580c23
ret 0x14

Function at 0x44860e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x5b1591
call fcn.00580b4b
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0040852d
and dword [ebp - 4], 0
push 0x68270c
lea eax, [ebp - 0x10]
push eax
call fcn.0040852d
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push 1
push 0x682748
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040856e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040856e
xor eax, eax
call fcn.00580c23
ret 0x14

Function at 0x4487cd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5bd33d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [ebp + 0x14]
lea eax, [esp + 8]
push eax
call fcn.0040852d
and dword [esp + 0x38], 0
lea eax, [esp + 4]
call fcn.0040877f
lea eax, [esp + 0xc]
push eax
call fcn.00413b2d
mov byte [esp + 0x38], 1
push 0x67c7e0
lea eax, [esp + 0xc]
push eax
call fcn.0040852d
mov byte [esp + 0x38], 2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call fcn.004486c5
pop ecx
pop ecx
mov byte [esp + 0x38], 1
lea ecx, [esp + 8]
call fcn.0040856e
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
push eax
call fcn.00424abe
pop ecx
mov byte [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
call fcn.0041288e
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 4]
call fcn.0040856e
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4494a0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x6bd6f8]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x30
mov eax, 0x5b0946
call fcn.00580b4b
mov eax, dword [ebp + 0x80c]
mov dword [ebp - 0x18], eax
push 0x400
lea eax, [ebp]
xor ebx, ebx
push eax
push ebx
mov edi, ecx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4495b1
cmp dword [edi + 0x78], ebx
jne 0x449506
mov dword [ebp - 0x10], ebx
jmp 0x449517
cmp dword [edi + 0x7c], 8
jb 0x449511
mov eax, dword [edi + 0x68]
jmp 0x449514
lea eax, [edi + 0x68]
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push eax
lea esi, [ebp - 0x3c]
call fcn.00408187
mov dword [ebp - 4], 1
lea ecx, [edi + 0x80]
cmp dword [ecx + 0x18], 8
jb 0x44953b
mov esi, dword [ecx + 4]
jmp 0x44953e
lea esi, [ecx + 4]
cmp dword [eax + 0x18], 8
jb 0x449549
mov ecx, dword [eax + 4]
jmp 0x44954c
lea ecx, [eax + 4]
cmp dword [edi + 0x60], 8
jb 0x449557
mov edx, dword [edi + 0x4c]
jmp 0x44955a
lea edx, [edi + 0x4c]
cmp dword [edi + 0x44], 8
jb 0x449565
mov eax, dword [edi + 0x30]
jmp 0x449568
lea eax, [edi + 0x30]
push ebx
push dword [ebp - 0x10]
push esi
push ebx
push str.UIGroup
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push edx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp - 0x3c]
call fcn.00409bbf
lea eax, [ebp - 0x1c]
push eax
push 7
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x493e0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push str._installed.
add edi, 0x48
push edi
push dword [ebp - 0x18]
call fcn.004499a9
add esp, 0xc
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0057340c
add ebp, 0x804
leave
ret 4
Function at 0x449675
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x6bd6f8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0x24], 0
je 0x449695
mov al, 1
jmp 0x44973f
cmp dword [ebp + 8], 2
jne 0x4496a1
and dword [esi + 0xc], 0
jmp 0x4496ff
push edi
xor edi, edi
push edi
push dword [0x6d6914]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4496b6
inc edi
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.005780d0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4496f8
cmp dword [ebp - 0x114], 6
jb 0x4496f8
or edi, 0x104
jmp 0x4496fb
or edi, 4
mov dword [esi + 0xc], edi
pop edi
mov eax, dword [ebp + 8]
and dword [esi + 0x10], 0
mov ecx, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
cmp eax, 4
je 0x449729
cmp eax, 1
je 0x449729
inc dword [0x6c3000]
mov eax, dword [0x6c3000]
mov dword [esi + 0x18], eax
jmp 0x44972d
and dword [esi + 0x18], 0
lea eax, [esi + 4]
push eax
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057340c
leave
ret 8

Function at 0x44974d
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push 0xc
mov eax, 0x5a653f
call fcn.00580b7e
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
je 0x449807
cmp dword [esi + 0x44], 8
jb 0x449783
mov ecx, dword [esi + 0x30]
jmp 0x449786
lea ecx, [esi + 0x30]
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x449807
lea ebx, [esi + 4]
push ebx
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call edi
test eax, eax
je 0x4497f6
cmp dword [esi + 8], 1
je 0x4497ef
push ebx
push 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4497f6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x4497f6
cmp dword [esi + 8], 3
jne 0x4497e3
push 0x1f4
jmp 0x4497c6
cmp dword [esi + 8], 1
jne 0x4497f6
or dword [ebp - 0x14], 2
jmp 0x4497f6
mov dword [ebp - 0x14], 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x449807
or dword [ebp - 0x14], 4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
call fcn.00580c23
ret
Function at 0x44a413
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b6a3b
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x6bd6f8]
xor eax, esp
mov dword [esp + 0x838], eax
push ebx
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x850]
mov dword fs:[0], eax
lea eax, [esp + 0x2c]
push eax
mov esi, ecx
call fcn.00413cf5
and dword [esp + 0x858], 0
lea ebx, [esp + 0x2c]
call fcn.0041c6c9
lea eax, [esi + 0x84]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x858], 1
lea eax, [esi + 0x34]
mov dword [esp + 0x24], eax
call fcn.0044e678
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x38]
xor ebx, ebx
sar eax, 2
test eax, eax
jbe 0x44a59b
lea eax, [esp + 0x20]
push eax
mov edi, ebx
lea esi, [esp + 0x30]
call fcn.004138a1
push eax
push 2
pop ecx
call fcn.004262df
mov dword [esp + 0x28], eax
mov byte [esp + 0x858], 2
call fcn.004138a1
mov edi, eax
mov eax, dword [esp + 0x28]
call fcn.00408591
mov byte [esp + 0x858], 1
lea ecx, [esp + 0x20]
call fcn.0040856e
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x4c], ax
lea eax, [esp + 0x4e]
push eax
call fcn.005780d0
add esp, 0xc
mov edi, ebx
call fcn.004138a1
mov eax, dword [eax]
push 0x400
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x44a587
lea eax, [esp + 0x10]
push eax
call fcn.004499f7
mov byte [esp + 0x858], 3
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004085d2
call fcn.004138a1
lea edi, [esp + 0x14]
call fcn.00408591
lea eax, [esp + 0x10]
call fcn.0040877f
mov eax, edi
call fcn.0040877f
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
call fcn.0044e611
mov byte [esp + 0x858], 1
lea eax, [esp + 0x10]
push eax
call fcn.004596d7
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x38]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x44a4aa
mov byte [esp + 0x858], 0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [esp + 0x858], 0xffffffff
lea eax, [esp + 0x2c]
push eax
call fcn.00413877
mov ecx, dword [esp + 0x850]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.0057340c
mov esp, ebp
pop ebp
ret
Function at 0x450ee2
Capabilities:
Get geographical location

Disassembly:
push 0x2c
mov eax, 0x5ae54c
call fcn.00580bb4
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edi
call fcn.004084d7
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], 0x37
mov dword [ebp - 0x28], 0x31
mov dword [ebp - 0x24], 0x32
mov dword [ebp - 0x20], 0x33
mov dword [ebp - 0x1c], 0x34
mov dword [ebp - 0x18], 0x35
mov dword [ebp - 0x14], 0x36
cmp esi, 7
jae 0x450fd8
mov esi, dword [ebp + esi*4 - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push edi
push edi
push esi
mov dword [ebp - 0x38], esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, edi
jle 0x450fd8
push eax
lea esi, [ebp - 0x2c]
call fcn.00425d9d
mov dword [ebp - 4], 1
push dword [ebp - 0x18]
mov eax, esi
call fcn.00425dbf
push eax
push dword [ebp - 0x38]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x450f98
lea eax, [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x450f9b
sub eax, edx
sar eax, 1
mov ecx, eax
lea eax, [ebp - 0x2c]
call fcn.00425ddf
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x450fbf
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call fcn.004085d2
mov byte [ebp - 4], 0
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bbf
mov eax, dword [ebp - 0x30]
call fcn.00580c37
ret
Function at 0x450fe1
Capabilities:
Get geographical location

Disassembly:
push 0x44
mov eax, 0x5b077d
call fcn.00580bb4
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], esi
call fcn.004084d7
mov dword [ebp - 4], esi
xor edi, edi
inc edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0x44
mov dword [ebp - 0x3c], 0x45
mov dword [ebp - 0x38], 0x46
mov dword [ebp - 0x34], 0x47
mov dword [ebp - 0x30], 0x48
mov dword [ebp - 0x2c], 0x49
mov dword [ebp - 0x28], 0x4a
mov dword [ebp - 0x24], 0x4b
mov dword [ebp - 0x20], 0x4c
mov dword [ebp - 0x1c], 0x4d
mov dword [ebp - 0x18], 0x4e
mov dword [ebp - 0x14], 0x4f
cmp ebx, 0xd
jae 0x4510fa
mov ebx, dword [ebp + ebx*4 - 0x44]
push esi
push esi
push ebx
mov dword [ebp - 0x50], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, esi
jle 0x4510fa
push eax
lea esi, [ebp - 0x2c]
call fcn.00425d9d
mov dword [ebp - 4], edi
push dword [ebp - 0x18]
xor edi, edi
mov eax, esi
call fcn.00425dbf
push eax
push dword [ebp - 0x50]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4510ba
lea eax, [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4510bd
sub eax, edx
sar eax, 1
mov ecx, eax
lea eax, [ebp - 0x2c]
call fcn.00425ddf
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4510e1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x48]
call fcn.004085d2
mov byte [ebp - 4], 0
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00409bbf
mov eax, dword [ebp - 0x48]
call fcn.00580c37
ret