joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55a3c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x2c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55a4b3
push 0
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x55a435
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a46d
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a46d
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a46d
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x3c]
mov edx, str.__
call fcn.00408350
jmp 0x55a483
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040bb30
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040a7d0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x55a4a5
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_CreateDirectoryW
or eax, eax
setne al
mov byte [ebp - 8], al
call fcn.0040d3b0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
pop eax
test eax, eax
je 0x55a4ef
call fcn.0040d520
mov al, byte [ebp - 8]
leave
ret
Function at 0x55a500
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x2c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55a5f1
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x55a573
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a5ab
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a5ab
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a5ab
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x3c]
mov edx, str.__
call fcn.00408350
jmp 0x55a5c1
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040bb30
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040a7d0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x55a5e3
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_RemoveDirectoryW
or eax, eax
setne al
mov byte [ebp - 8], al
call fcn.0040d3b0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
pop eax
test eax, eax
je 0x55a62d
call fcn.0040d520
mov al, byte [ebp - 8]
leave
ret
Function at 0x55b260
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55b364
push dword [ebp - 8]
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x55b2d9
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55b311
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55b311
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55b311
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x40]
mov edx, str.__
call fcn.00408350
jmp 0x55b327
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x40]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040bb30
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040a7d0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x55b349
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x55b35c
mov dword [ebp - 0xc], 0
jmp 0x55b364
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0xc], eax
call fcn.0040d3b0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
pop eax
test eax, eax
je 0x55b3a0
call fcn.0040d520
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x55bfc0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x38]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c0da
mov byte [ebp - 0xc], 0
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x60]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c066
mov eax, dword [ebp - 8]
and eax, 0x31a7
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x68]
call fcn.0040a610
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.0040bb30
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x14]
call fcn.0040a7d0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x55c058
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_SetFileAttributesW
or eax, eax
setne al
mov byte [ebp - 0xc], al
call fcn.0040d3b0
pop eax
test eax, eax
je 0x55c0da
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x74]
lea edx, [ebp - 0x8c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c0b7
mov edx, 0x6dc92c
mov ecx, str.SetFileAttrWIN___Exception
mov eax, 0
call fcn.00420b20
mov ecx, ebp
mov edx, 0x55c0ab
call fcn.0040d310
call fcn.0040d3b0
pop eax
test eax, eax
je 0x55c0d0
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
call fcn.0040d3b0
lea edx, [ebp - 0x68]
mov eax, edx
call fcn.0040a610
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x14]
mov eax, edx
call fcn.00409310
mov dword [ebp - 0x14], 0
pop eax
test eax, eax
je 0x55c10b
call fcn.0040d520
mov al, byte [ebp - 0xc]
leave
ret
Function at 0x55c110
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x38]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c234
mov byte [ebp - 0xc], 0
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x60]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c1c0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
and eax, 0x80
jne 0x55c17e
or dword [ebp - 0x10], 1
lea eax, [ebp - 0x68]
call fcn.0040a610
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.0040bb30
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x14]
call fcn.0040a7d0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x55c1b2
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_SetFileAttributesW
or eax, eax
setne al
mov byte [ebp - 0xc], al
call fcn.0040d3b0
pop eax
test eax, eax
je 0x55c234
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x74]
lea edx, [ebp - 0x8c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55c211
mov edx, 0x6dc92c
mov ecx, str.SetFileACLUnix___Exception
mov eax, 0
call fcn.00420b20
mov ecx, ebp
mov edx, 0x55c205
call fcn.0040d310
call fcn.0040d3b0
pop eax
test eax, eax
je 0x55c22a
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
call fcn.0040d3b0
lea edx, [ebp - 0x68]
mov eax, edx
call fcn.0040a610
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x14]
mov eax, edx
call fcn.00409310
mov dword [ebp - 0x14], 0
pop eax
test eax, eax
je 0x55c265
call fcn.0040d520
mov al, byte [ebp - 0xc]
leave
ret

Function at 0x578ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x578b21
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp - 0x10]
jb 0x578b21
dec dword [ebp - 0x10]
nop
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
mov cl, byte [esi + ebx]
xor dl, cl
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov byte [ebx + ecx], dl
cmp eax, dword [ebp - 0x10]
ja 0x578afc
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
leave
ret
Function at 0x5de8d0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
cmp byte [0x7d1970], 0
jne 0x5de9b8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5de967
mov eax, dword [0x7d1980]
call fcn.006081e0
mov eax, dword [0x7d1980]
mov ecx, 4
mov edx, str.wuauserv
call fcn.00608b40
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call fcn.00608ec0
test eax, eax
je 0x5de95d
mov eax, dword [ebp - 0x20]
cmp eax, 2
je 0x5de939
cmp eax, 4
sete al
and eax, 0xff
neg eax
je 0x5de95d
mov eax, dword [0x7d1980]
mov cl, 0
mov edx, str.wuauserv
call fcn.00608a80
mov byte [0x7d1970], 1
mov eax, dword [0x7d1980]
call fcn.006083c0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5de9b8
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x58]
lea edx, [ebp - 0x70]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5de995
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5de9ae
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
leave
ret
Function at 0x6028d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
push 7
mov eax, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call dword [ecx + 0x8c]
cmp edx, 0xffffffff
jne 0x602912
cmp eax, 0xffffffff
jne 0x602912
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 4]
call fcn.005ecbc0
mov eax, dword [ebp - 4]
call fcn.005ecb20
mov eax, dword [ebp - 4]
call fcn.005ecb20
mov eax, dword [ebp - 4]
call fcn.005ecb60
mov eax, dword [ebp - 4]
call fcn.005ecb60
mov eax, dword [ebp - 4]
call fcn.005ecb20
mov eax, dword [ebp - 4]
call fcn.005ecbc0
mov eax, dword [ebp - 4]
call fcn.005ecbc0
mov eax, dword [ebp - 4]
call fcn.005ecbc0
mov eax, dword [ebp - 4]
call fcn.005ecbc0
mov eax, dword [ebp - 4]
call fcn.005ecbc0
cmp eax, 0x80
je 0x60297a
mov byte [ebp - 0xc], 0
jmp 0x602aa4
push 0
push 0x54
mov eax, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call dword [ecx + 0x8c]
cmp edx, 0xffffffff
jne 0x6029a4
cmp eax, 0xffffffff
jne 0x6029a4
mov byte [ebp - 0xc], 0
jmp 0x602aa4
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
mov edx, 0x6c
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0xa0]
cmp eax, 0x6c
je 0x6029c8
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov dword [ebp - 0x10], 1
dec dword [ebp - 0x10]
mov esi, esi
inc dword [ebp - 0x10]
lea ebx, [ebp - 0x7c]
mov eax, dword [ebp - 0x10]
dec eax
lea esi, [ebp - 0x7c]
mov edx, dword [ebp - 0x10]
dec edx
mov ecx, dword [ebp - 0x10]
dec ecx
mov dl, byte [esi + edx]
mov cl, byte [ecx + 0x786340]
xor dl, cl
mov byte [ebx + eax], dl
cmp dword [ebp - 0x10], 0x6c
jb 0x6029d4
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x602a0d
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 0x6c]
cmp eax, 0x6c
je 0x602a1e
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 0x68]
cmp eax, 4
je 0x602a2f
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 0x38]
cmp eax, 0x20
je 0x602a3d
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 0x34]
cmp eax, 0x80
je 0x602a4d
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov eax, dword [ebp - 0x30]
cmp eax, 0x40
je 0x602a5b
mov byte [ebp - 0xc], 0
jmp 0x602aa4
mov dword [ebp - 0x10], 1
dec dword [ebp - 0x10]
lea esi, [esi]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec eax
movzx edx, byte [ebp - 0x10]
mov al, byte [ebp + eax - 0x7c]
cmp al, byte [edx + str._vAcFssFcAJMB]
je 0x602a85
mov byte [ebp - 0xc], 0
jmp 0x602aa4
cmp dword [ebp - 0x10], 0xc
jb 0x602a68
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
add edx, 0x6c
adc eax, 0
mov dword [ecx + 0x28], edx
mov dword [ecx + 0x2c], eax
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
mov ebx, dword [ebp - 0x84]
mov esi, dword [ebp - 0x80]
leave
ret
Function at 0x608400
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x44]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x6085d1
mov eax, dword [ebp - 4]
call fcn.006081d0
mov edx, dword [str.Query_service_list]
mov eax, dword [ebp - 4]
call fcn.00608120
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x14]
push 3
push 0x30
mov eax, dword [ebp - 4]
push dword [eax + 0x38]
call fcn.00608e90
call sub.kernel32.dll_GetLastError
cmp eax, 0xea
je 0x60849d
call fcn.004219a0
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x14]
call fcn.0040f310
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0x6c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x6085a9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
push 3
push 0x30
mov eax, dword [ebp - 4]
push dword [eax + 0x38]
call fcn.00608e90
test eax, eax
jne 0x6084f6
call fcn.004219a0
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], 1
cmp ebx, dword [ebp - 0x20]
jl 0x6085a9
dec dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.004b4480
mov edx, eax
mov eax, 0x7889c0
call fcn.0040c430
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x74]
call fcn.00404c10
mov dword [ebp - 0x74], 0
lea edx, [ebp - 0x74]
mov eax, dword [esi]
call fcn.004201b0
mov eax, dword [ebp - 0x74]
call fcn.00408320
mov edi, dword [ebp - 0x1c]
lea eax, [edi + 0x10]
call fcn.00404c10
mov eax, dword [ebp - 0x74]
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x74]
call fcn.00404c10
mov dword [ebp - 0x74], 0
lea edx, [ebp - 0x74]
mov eax, dword [esi + 4]
call fcn.004201b0
mov eax, dword [ebp - 0x74]
call fcn.00408320
mov edi, dword [ebp - 0x1c]
lea eax, [edi + 0x14]
call fcn.00404c10
mov eax, dword [ebp - 0x74]
mov dword [edi + 0x14], eax
lea edx, [esi + 8]
mov eax, dword [ebp - 0x1c]
call fcn.00608e30
add dword [ebp - 0x18], 0x24
cmp ebx, dword [ebp - 0x20]
jg 0x60850c
call fcn.0040d3b0
mov eax, dword [ebp - 0x14]
call fcn.0040f350
pop eax
test eax, eax
je 0x6085c3
dec eax
test eax, eax
call fcn.0040d520
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call dword [edx + 0xe0]
call fcn.0040d3b0
lea eax, [ebp - 0x74]
call fcn.00404c10
mov dword [ebp - 0x74], 0
pop eax
test eax, eax
je 0x6085ef
call fcn.0040d520
mov ebx, dword [ebp - 0x80]
mov esi, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x78]
leave
ret
Function at 0x6087a0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x74], 0
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x44]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x6088d7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
call dword [edx + 0xb0]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00608e80
test eax, eax
jne 0x6088d7
call sub.kernel32.dll_GetLastError
cmp eax, 0xea
je 0x60881d
call fcn.004219a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.0040f310
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0x6c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x6088bd
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00608e80
test eax, eax
jne 0x608868
call fcn.004219a0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x20]
dec ebx
mov dword [ebp - 0x18], 0
cmp ebx, dword [ebp - 0x18]
jb 0x6088bd
dec dword [ebp - 0x18]
lea esi, [esi]
inc dword [ebp - 0x18]
lea eax, [ebp - 0x74]
call fcn.00404c10
mov dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
lea edx, [ebp - 0x74]
call fcn.004201b0
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
add dword [ebp - 0x14], 0x24
cmp ebx, dword [ebp - 0x18]
ja 0x608884
call fcn.0040d3b0
mov eax, dword [ebp - 0x10]
call fcn.0040f350
pop eax
test eax, eax
je 0x6088d7
dec eax
test eax, eax
call fcn.0040d520
call fcn.0040d3b0
lea eax, [ebp - 0x74]
call fcn.00404c10
mov dword [ebp - 0x74], 0
pop eax
test eax, eax
je 0x6088f5
call fcn.0040d520
mov ebx, dword [ebp - 0x78]
leave
ret 4
Function at 0x608900
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov byte [ebp - 8], cl
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x54]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x608a42
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call fcn.00608ec0
test eax, eax
jne 0x60895b
call fcn.004219a0
mov eax, dword [ebp - 0x2c]
cmp eax, 1
je 0x608a42
cmp byte [ebp - 8], 0
je 0x608a2b
mov edx, 0x726560
mov eax, 0
call fcn.0040c4b0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x7c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x608a11
push dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, 1
call fcn.006087a0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
call dword [edx + pe_nt_image_headers32]
mov ebx, eax
dec ebx
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x10]
jl 0x608a11
dec dword [ebp - 0x10]
inc dword [ebp - 0x10]
lea eax, [ebp - 0x84]
call fcn.00404c10
mov dword [ebp - 0x84], 0
lea ecx, [ebp - 0x84]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
call dword [esi + 0x78]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc]
mov cl, 0
call fcn.00608a80
cmp ebx, dword [ebp - 0x10]
jg 0x6089d0
call fcn.0040d3b0
mov eax, dword [ebp - 0x14]
call fcn.0040c5c0
pop eax
test eax, eax
je 0x608a2b
dec eax
test eax, eax
call fcn.0040d520
lea eax, [ebp - 0x30]
push eax
push 1
push dword [ebp - 4]
call fcn.00608e70
test eax, eax
jne 0x608a42
call fcn.004219a0
call fcn.0040d3b0
lea eax, [ebp - 0x84]
call fcn.00404c10
mov dword [ebp - 0x84], 0
pop eax
test eax, eax
je 0x608a66
call fcn.0040d520
mov ebx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x88]
leave
ret
Function at 0x60fdb0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], eax
cmp byte [0x7980a0], 0
jne 0x60fdc7
jmp 0x60fea6
mov dword [ebp - 0x58], 8
mov eax, fcn.0060a3c0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
call fcn.00412ab0
mov dword [ebp - 0x48], eax
mov eax, str.MAINICON
push eax
push dword [0x7cbe10]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x60fe09
jmp 0x60fe18
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x44], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, str.Window
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
jne 0x60fe57
jmp 0x60fea1
mov eax, dword [ebp - 0x58]
or eax, 0x800
mov dword [ebp - 0x58], eax
mov eax, dword [0x7980b0]
cmp eax, 6
jae 0x60fe6e
jmp 0x60fe79
mov eax, dword [ebp - 0x58]
or eax, 0x20000
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov eax, str.HintWindow
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_RegisterClassW
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
jmp 0x60ff80
mov dword [ebp - 0x30], 8
mov eax, fcn.0060a3c0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00412ab0
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x7cbe10]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x60fee8
jmp 0x60fef7
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, 0x789830
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
jne 0x60ff36
jmp 0x60ff80
mov eax, dword [ebp - 0x30]
or eax, 0x800
mov dword [ebp - 0x30], eax
mov eax, dword [0x7980b0]
cmp eax, 6
jae 0x60ff4d
jmp 0x60ff58
mov eax, dword [ebp - 0x30]
or eax, 0x20000
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, 0x789840
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassA
movzx eax, ax
test eax, eax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret
Function at 0x610bc0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x14]
test eax, eax
jne 0x610bf3
jmp 0x610c79
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax - 0x1c]
cmp eax, 0
jg 0x610c11
jmp 0x610c79
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x610c56
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040d3b0
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x610c75
dec eax
test eax, eax
je 0x610c70
call fcn.0040d520
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
mov ebx, dword [ebp - 0x38]
leave
ret