joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407a10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a538
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x40f484]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x80], eax
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 4], eax
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x407a75
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.004077b0
lea ecx, [ebp - 0x7c]
call fcn.00407860
push esi
lea ecx, [ebp - 0x7c]
call fcn.00407940
cmp dword [ebp + 0x20], 0x10
jb 0x407aa5
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040937e
mov esp, ebp
pop ebp
ret

Function at 0x40937e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f484]
jne 0x409388
repz ret
jmp fcn.00409828
Function at 0x404250
Capabilities:
Get common file path
Get disk information
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x458588]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x45858c]
push esi
mov dword [ebp - 0x14], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], edx
call fcn.00404240
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x458590]
mov edx, dword [0x458594]
add edi, 0x23f
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea esp, [esp]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x45fd1c]
shl esi, 4
add esi, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x4042dc
mov dword [0x45fd18], 0xedeb2e40
jmp 0x4042f7
cmp eax, 0x3eb
jne 0x4042f7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x45f7a8], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x45fd1c], 0x9e6
mov dword [0x45fd14], 0xf4ea3dee
jne 0x404330
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x45fd1c], 0x213
jne 0x4043b8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
lea eax, [ebp - 0x4c0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
lea ecx, [ebp - 0xcc0]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
lea edx, [ebp - 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub ebx, dword [ebp - 4]
cmp dword [0x45fd1c], 0xc
jne 0x4043cc
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, ebx
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add eax, dword [ebp - 0x1c]
lea ecx, [edi + ebx]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x4042b0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404420
Capabilities:
Clear file content
Connect pipe
Read pipe
Set file attributes
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040a890
mov eax, dword [0x45fd1c]
mov ecx, dword [0x45f7ac]
shr eax, 3
test eax, eax
jbe 0x404514
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x45fd1c], 0x959
jne 0x4044fa
push 0
push 0
push 0
call edi
push 0
lea eax, [ebp - 0x808]
push eax
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea ecx, [ebp - 0x1008]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 4]
push edx
call fcn.00404250
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407750
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x457668]
jne 0x40775a
repz ret
jmp fcn.0040c7ee

Function at 0x40c415
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408a4b
and dword [ebp - 4], 0
cmp dword [0x45d798], 0
mov ebx, eax
jne 0x40c4c6
push 0x401d44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c577
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401d38
push edi
call esi
test eax, eax
je 0x40c577
push eax
call fcn.004089d9
mov dword [esp], 0x401d28
push edi
mov dword [0x45d798], eax
call esi
push eax
call fcn.004089d9
mov dword [esp], 0x401d14
push edi
mov dword [0x45d79c], eax
call esi
push eax
call fcn.004089d9
mov dword [esp], 0x401cf8
push edi
mov dword [0x45d7a0], eax
call esi
push eax
call fcn.004089d9
pop ecx
mov dword [0x45d7a8], eax
test eax, eax
je 0x40c4c6
push 0x401ce0
push edi
call esi
push eax
call fcn.004089d9
pop ecx
mov dword [0x45d7a4], eax
mov eax, dword [0x45d7a4]
cmp eax, ebx
je 0x40c51e
cmp dword [0x45d7a8], ebx
je 0x40c51e
push eax
call fcn.00408a54
push dword [0x45d7a8]
mov esi, eax
call fcn.00408a54
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c51e
test edi, edi
je 0x40c51e
call esi
test eax, eax
je 0x40c515
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c515
test byte [ebp - 0xc], 1
jne 0x40c51e
or dword [ebp + 0x10], 0x200000
jmp 0x40c557
mov eax, dword [0x45d79c]
cmp eax, ebx
je 0x40c557
push eax
call fcn.00408a54
pop ecx
test eax, eax
je 0x40c557
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c557
mov eax, dword [0x45d7a0]
cmp eax, ebx
je 0x40c557
push eax
call fcn.00408a54
pop ecx
test eax, eax
je 0x40c557
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45d798]
call fcn.00408a54
pop ecx
test eax, eax
je 0x40c577
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c579
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402fdc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0xc]
mov dword [edx + 8], 0x67452301
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0x98badcfe
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret

Function at 0x406a94
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov eax, 0x4b3df0
call fcn.00497a7c
mov word [ebp - 0x28], 8
lea eax, [ebp - 4]
call fcn.00402a14
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x14
mov word [ebp - 0x28], 0x20
lea eax, [ebp - 8]
call fcn.00402a14
mov edx, eax
inc dword [ebp - 0x1c]
mov ecx, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [ecx]
call sub.vcl60.bpl__Forms_TApplication_GetExeName_qqrv
lea edx, [ebp - 8]
push dword [edx]
lea eax, [ebp - 0xc]
call fcn.00402a14
mov edx, eax
inc dword [ebp - 0x1c]
pop eax
call sub.rtl60.bpl__Sysutils_ExtractFilePath_qqrx17System_AnsiString
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
call fcn.00402a14
push eax
inc dword [ebp - 0x1c]
mov edx, 0x4b0a64
lea eax, [ebp - 0x10]
call fcn.00497bd0
inc dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
pop ecx
pop eax
call fcn.00497e78
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00497e50
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00497e20
push 1
push 0
push 0
lea eax, [ebp - 4]
call fcn.00402a98
push eax
push 0x4b0a71
mov eax, dword [sym.servercontrol.exe__SdServerForm]
call sub.vcl60.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.SHELL32.dll_ShellExecuteA
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4173ec
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
mov eax, 0x4b8d84
call fcn.00497a7c
xor edx, edx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x14], 8
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x2c], eax
push 0xf01ff
push 0x4b2634
push dword [ebp - 0x2c]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x41749a
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x424
jne 0x41746e
push 0x10
mov ecx, 0x4b2669
mov edx, 0x4b2642
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
jmp 0x417486
push 0x10
mov ecx, 0x4b26a1
mov edx, 0x4b266e
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x24]
push ecx
call sub.CC3260MT.DLL___Return_unwind
pop ecx
jmp 0x4175d6
lea eax, [ebp - 0x54]
push eax
push 1
push dword [ebp - 0x30]
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x417527
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x41d
jne 0x4174f2
push 0x10
mov ecx, 0x4b26c0
mov edx, 0x4b26a6
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x24]
push ecx
call sub.CC3260MT.DLL___Return_unwind
pop ecx
jmp 0x4175d6
cmp dword [ebp - 0x38], 0x426
je 0x417527
push 0x10
mov ecx, 0x4b26f2
mov edx, 0x4b26c5
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x24]
push ecx
call sub.CC3260MT.DLL___Return_unwind
pop ecx
jmp 0x4175d6
push 0xfa0
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x30]
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x50], 4
jne 0x41754f
mov dl, 1
mov eax, dword [ebp - 0x28]
call fcn.00416f1c
jmp 0x417594
cmp dword [ebp - 0x50], 1
jne 0x417594
xor edx, edx
mov eax, dword [ebp - 0x28]
call fcn.00416f1c
mov eax, dword [ebp - 0x28]
call fcn.0040adec
test al, al
je 0x417594
push 0xf01ff
push 0x4b26f7
push dword [ebp - 0x2c]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x417594
lea edx, [ebp - 0x54]
push edx
push 1
push dword [ebp - 0x34]
call sub.advapi32.dll_ControlService
mov word [ebp - 0x14], 0
cmp dword [ebp - 0x30], 0
je 0x4175a8
push dword [ebp - 0x30]
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x34], 0
je 0x4175b6
push dword [ebp - 0x34]
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x2c], 0
je 0x4175c4
push dword [ebp - 0x2c]
call sub.advapi32.dll_CloseServiceHandle
cmp word [ebp - 0x12], 0
je 0x4175cc
ret
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov edi, dword [ebp - 0x60]
mov esi, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
mov esp, ebp
pop ebp
ret
Function at 0x41aa90
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov dword [ebp - 0x40], eax
mov eax, 0x4b9cfc
call fcn.00497a7c
mov word [ebp - 0x2c], 8
lea eax, [ebp - 4]
call fcn.00402a14
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 0x14
mov byte [ebp - 0x41], 0
mov word [ebp - 0x2c], 0x20
lea eax, [ebp - 0xc]
call fcn.00402a14
push eax
inc dword [ebp - 0x20]
mov edx, 0x4b2b9b
lea eax, [ebp - 8]
call fcn.00497bd0
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
mov eax, 0x4d870c
pop ecx
call fcn.00497e78
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00497e50
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00497e20
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
jne 0x41abf3
mov word [ebp - 0x2c], 0x38
lea eax, [ebp - 0x14]
call fcn.00402a14
mov ecx, eax
inc dword [ebp - 0x20]
lea edx, [ebp - 4]
mov eax, 0x4b2ba9
call fcn.004982ac
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
call fcn.00402a14
push eax
inc dword [ebp - 0x20]
mov edx, 0x4b2bb7
lea eax, [ebp - 0x18]
call fcn.00497bd0
inc dword [ebp - 0x20]
lea edx, [ebp - 0x18]
pop ecx
pop eax
call fcn.00497e78
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00497e20
mov word [ebp - 0x2c], 0x2c
push 0x10
lea eax, [ebp - 0x10]
call fcn.00402a98
mov edx, eax
mov ecx, 0x4b2bc0
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
mov al, byte [ebp - 0x41]
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
jmp 0x41ac9a
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x2c], 0x44
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x48], eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.00402a98
push eax
push 1
push 3
push 0x10
push 0xf01ff
push 0x4b2bd3
push 0x4b2bc5
push dword [ebp - 0x48]
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x2c], 0x14
cmp dword [ebp - 0x4c], 0
je 0x41ac65
push dword [ebp - 0x4c]
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 0x41], 1
cmp dword [ebp - 0x48], 0
je 0x41ac73
push dword [ebp - 0x48]
call sub.advapi32.dll_CloseServiceHandle
cmp word [ebp - 0x2a], 0
je 0x41ac7b
ret
mov al, byte [ebp - 0x41]
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
pop eax
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
mov edi, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x70]
mov esp, ebp
pop ebp
ret
Function at 0x41aca8
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
mov eax, 0x4b9d5c
call fcn.00497a7c
xor edx, edx
mov dword [ebp - 0x30], edx
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x18], 8
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x30], eax
push 0xf01ff
push 0x4b2be4
push dword [ebp - 0x30]
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x424
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x34]
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x6c], 4
jne 0x41ad4b
lea edx, [ebp - 0x70]
push edx
push 1
push dword [ebp - 0x34]
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x41ad4b
push 0x10
mov ecx, 0x4b2c05
mov edx, 0x4b2bf2
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0x28]
push ecx
call sub.CC3260MT.DLL___Return_unwind
pop ecx
jmp 0x41add3
push dword [ebp - 0x34]
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x41ad87
mov word [ebp - 0x18], 0x14
mov edx, 0x4b2c0a
lea eax, [ebp - 4]
call fcn.00497bd0
inc dword [ebp - 0xc]
push dword [eax]
call fcn.0042ad50
pop ecx
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
jmp 0x41ad9f
push 0x10
mov ecx, 0x4b2c42
mov edx, 0x4b2c2f
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call fcn.00497b24
mov word [ebp - 0x18], 0
cmp dword [ebp - 0x34], 0
je 0x41adb3
push dword [ebp - 0x34]
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x30], 0
je 0x41adc1
push dword [ebp - 0x30]
call sub.advapi32.dll_CloseServiceHandle
cmp word [ebp - 0x16], 0
je 0x41adc9
ret
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x74]
mov esp, ebp
pop ebp
ret
Function at 0x42b4f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
push esi
push edi
mov eax, 0x4beaa4
call fcn.00497a7c
mov esi, 0x4be2f5
lea edi, [ebp - 0xb4]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x38], 8
lea eax, [ebp - 4]
call fcn.00402a14
inc dword [ebp - 0x2c]
mov word [ebp - 0x38], 0x14
mov word [ebp - 0x38], 0x20
lea eax, [ebp - 8]
call fcn.00402a14
inc dword [ebp - 0x2c]
mov word [ebp - 0x38], 0x14
mov word [ebp - 0x38], 0x2c
lea eax, [ebp - 0xc]
call fcn.00402a14
inc dword [ebp - 0x2c]
mov word [ebp - 0x38], 0x14
mov byte [ebp - 0x4d], 0
push 0x64
lea edx, [ebp - 0xb4]
push edx
push 0x1f
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
mov word [ebp - 0x38], 0x38
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x10]
call fcn.00497bd0
mov edx, eax
inc dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00497e50
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00497e20
push 0x64
lea ecx, [ebp - 0xb4]
push ecx
push 0x1003
push 0x400
call sub.kernel32.dll_GetLocaleInfoA
mov word [ebp - 0x38], 0x44
lea edx, [ebp - 0xb4]
lea eax, [ebp - 0x14]
call fcn.00497bd0
mov edx, eax
inc dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.00497e50
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00497e20
mov word [ebp - 0x38], 0x50
mov edx, 0x4be646
lea eax, [ebp - 0x18]
call fcn.00497bd0
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00497f1c
push eax
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00497e20
pop ecx
test cl, cl
je 0x42b67b
mov byte [ebp - 0x4d], 1
push 0x4be651
push 0x1f
push 0x400
call sub.kernel32.dll_SetLocaleInfoA
mov word [ebp - 0x38], 0x5c
mov edx, 0x4be65c
lea eax, [ebp - 0x1c]
call fcn.00497bd0
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x1c]
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_ShortDateFormat]
call fcn.00497e50
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00497e20
mov ecx, dword [sym.imp.rtl60.bpl__Sysutils_DateSeparator]
mov byte [ecx], 0x2d
mov word [ebp - 0x38], 0x68
mov edx, 0x4be667
lea eax, [ebp - 0x20]
call fcn.00497bd0
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00497f1c
push eax
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00497e20
pop ecx
test cl, cl
je 0x42b705
mov byte [ebp - 0x4d], 1
push 0x4be670
push 0x1003
push 0x400
call sub.kernel32.dll_SetLocaleInfoA
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_TimeSeparator]
mov byte [eax], 0x3a
mov word [ebp - 0x38], 0x74
mov edx, 0x4be679
lea eax, [ebp - 0x24]
call fcn.00497bd0
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x24]
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_ShortTimeFormat]
call fcn.00497e50
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00497e20
dec dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
mov ecx, dword [ebp - 0x48]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42dc80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
mov dword [ebp - 4], edx
mov dword [ebp - 0x30], eax
mov eax, 0x4bfb68
call fcn.00497a7c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00497c08
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 8
push 0x44
push 0
lea edx, [ebp - 0x88]
push edx
call sub.CC3260MT.DLL__memset
add esp, 0xc
mov dword [ebp - 0x88], 0x44
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x44]
push ecx
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.00402a98
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x42dd66
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov word [ebp - 0x1c], 0x20
mov edx, 0x4bf792
lea eax, [ebp - 8]
call fcn.00497bd0
inc dword [ebp - 0x10]
mov ecx, dword [eax]
mov dl, 1
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_Exception_]
call sub.rtl60.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiString
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00497e20
mov word [ebp - 0x1c], 0x14
lea ecx, [ebp - 0x34]
push ecx
push 0x402fc4
call sub.CC3260MT.DLL___ThrowExceptionLDTC_qpvt1t1t1uiuiuipuct1
add esp, 0x24
jmp 0x42dd80
push 0xffffffffffffffff
push dword [ebp - 0x44]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0x44]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x40]
call sub.kernel32.dll_CloseHandle
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00497e20
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x430b50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x430ba5
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x430ba5
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x430ba5
mov edx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
call sub.vcl60.bpl__Controls_TControl_SetLeft_qqri
mov dl, 5
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x2f0]
call sub.vcl60.bpl__Controls_TControl_SetAlign_qqr15Controls_TAlign
jmp 0x430bad
mov eax, dword [ebp - 4]
call sub.vcl60.bpl__Forms_TCustomForm_Close_qqrv
pop ecx
pop ecx
pop ebp
ret

Function at 0x430c64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 1
push 0
push 0
push 0x4c0796
push 0x4c0791
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov edx, dword [eax]
mov eax, dword [edx + 0x44]
call sub.vcl60.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.SHELL32.dll_ShellExecuteA
pop ecx
pop ecx
pop ebp
ret