joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d9220
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5d9232
add esp, 0xfffffff0
call fcn.004090bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c4b90
mov eax, dword [0x6314ec]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d96e8
mov eax, dword [0x6314fc]
mov dword [eax + 4], ebx
mov dword [eax], 0x5d96f4
mov eax, ebx
call fcn.005d9700
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0x84], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x50], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x5d3cf0
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.005d9cdc
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d9b0c
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d9b0c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d9b0c
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d9b0c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5d9b0c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5d93b2
call fcn.00409114
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d98ac
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5d9a57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5d9a38
mov dl, 1
mov eax, dword [0x4903e4]
call fcn.004b3e64
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a944
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5d9a27
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0053b214
test al, al
je 0x5d9a1a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5d9a68
lea eax, [ebp - 0x394]
call fcn.00425c1c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5d9a1a
xor eax, eax
push ebp
push 0x5d9a13
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5d9ad8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5d99fc
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b870
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5d99fc
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040b870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9a1a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5d991d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b3d88
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9a5e
lea eax, [ebp - 0x3a0]
call fcn.0040a944
ret

Function at 0x5da610
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x6380d0]
cmp byte [eax + 0xc5], 0
jne 0x5da682
cmp dword [0x6380f4], 0
jne 0x5da642
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x630c4c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x6380f4], eax
cmp dword [0x6380f0], 0
jne 0x5da65d
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x6380f0], eax
cmp dword [0x6380f8], 0
jne 0x5da682
push esp
push 0
push 0
mov eax, dword [0x630c48]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x6380f8], eax
pop edx
ret
Function at 0x5daaa4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5daabb
add esp, 0xfffffff0
call fcn.004090bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c4b90
mov eax, dword [0x631374]
cmp byte [eax], 0
jne 0x5daae8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x631730]
cmp word [eax + 2], 0
jne 0x5dab02
mov eax, dword [0x631730]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005dcd7c
mov eax, dword [0x631894]
cmp word [eax + 2], 0
jne 0x5dab1c
mov eax, dword [0x631894]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005dcf80
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x502770]
call fcn.005088d4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5dd4f8
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x507198]
call fcn.00511ff4
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5dad04
mov eax, dword [0x6315ac]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051248c
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5dd7e0
mov dl, 1
mov eax, dword [0x48ca64]
call fcn.00408a04
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6315ac]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425a1c
test eax, eax
je 0x5dac36
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425874
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425a00
test eax, eax
je 0x5dac4e
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040b870
push ebx
push 0x5dc758
call fcn.005cff08
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x631374]
cmp byte [eax], 0
jne 0x5dac9f
mov eax, ebx
call fcn.005daeec
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005dda18
mov eax, ebx
call fcn.005de678
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5dacfc
call fcn.00409114
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5db230
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5db2d2
cmp dword [ebx + 0xac], 0
jne 0x5db2cc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5db16c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5db2cc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5db292
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5db2cc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004af424
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5db2a1
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5db510
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x6380d0]
cmp dword [eax + 0x188], 0
je 0x5db68a
test bl, bl
jne 0x5db5d5
cmp dword [esi + 0xb4], 0
jne 0x5db5ca
mov eax, esi
call fcn.005de4c8
push eax
push 0x5db404
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5db59b
mov eax, dword [0x6380d0]
cmp byte [eax + 0xeb], 0
je 0x5db59b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5db57c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5db59b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5db584
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5db5ca
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004af424
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5db5aa
inc dword [esi + 0xb4]
jmp 0x5db68a
cmp dword [esi + 0xb4], 0
jle 0x5db68a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5db68a
cmp dword [esi + 0x58], 0
je 0x5db63f
mov eax, dword [0x6380d0]
cmp byte [eax + 0xeb], 0
je 0x5db63f
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5db620
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5db63f
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5db628
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5db66e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004af424
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5db64e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5cc77c]
call fcn.0040d308
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5dc2e4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5dc341
cmp byte [ebx + 0xeb], 0
jne 0x5dc341
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040aacc
mov eax, dword [esi]
test eax, eax
je 0x5dc32e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5dc34e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ad24
jmp 0x5dc34e
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040ad24
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5ddc00
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5ddc71
mov eax, esi
call fcn.00534d24
test al, al
je 0x5ddc71
mov eax, dword [ebx + 0x98]
call fcn.00534950
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ddc71
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x128]
test al, al
je 0x5ddc62
push 0
mov eax, dword [ebx + 0x98]
call fcn.00534950
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0052b480
jmp 0x5ddc71
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005dda38
pop esi
pop ebx
ret
Function at 0x61e7f4
Capabilities:
Hash data using sha224

Disassembly:
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
test edi, 0xecd81c40
das
adc eax, 0x312040c7
or eax, eax
inc edi
inc eax
and al, 0x67
xor esp, dword es:[edi - 0x39]
inc eax
sub byte [ecx], dl
adc eax, 0x40c76858
sub al, 0x87
dec edx
mov ah, 0x8e

Function at 0x61f804
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.0040aa28
mov eax, dword [ebp - 0x10]
call fcn.0040aa38
mov eax, dword [ebp - 0x14]
call fcn.0040aa38
xor eax, eax
push ebp
push 0x61f977
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x493398]
call fcn.004b65d0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404d6c]
call fcn.0040d1e4
add esp, 4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.004b4310
mov eax, dword [ebp - 0x18]
call fcn.00408a34
push ebp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
xor eax, eax
call fcn.0061f6e8
pop ecx
test eax, eax
jl 0x61f933
lea ecx, [ebp - 0xc]
mov edx, 0x61f994
mov eax, dword [ebp - 8]
call fcn.0042561c
mov eax, dword [ebp - 0xc]
call fcn.0040b7cc
push eax
mov eax, dword [ebp - 8]
call fcn.0040b7cc
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
push 0xff00
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x493398]
call fcn.004b65d0
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x61f92a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x61f907
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.004b5b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f931
mov eax, dword [ebp - 0x18]
call fcn.00408a34
ret
lea eax, [ebp - 4]
mov edx, dword [0x404d6c]
call fcn.0040d308
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61f97e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040a9d4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040a9a4
lea eax, [ebp - 4]
mov edx, dword [0x404d6c]
call fcn.0040d308
ret

Function at 0x61faa8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0
push 0
push 0x23
push 0
call sub.shell32.dll_SHGetFolderPathW
mov edx, ebx
mov eax, esp
call fcn.00425b04
add esp, 0x100
pop ebx
ret
Function at 0x61fad0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa28
mov eax, dword [ebp - 8]
call fcn.0040aa28
xor eax, eax
push ebp
push 0x61fbd0
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7cc
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x61fbae
push 0x24
mov eax, dword [ebp - 8]
call fcn.0040b7cc
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x61fba8
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x61fba2
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x61fba2
jmp 0x61fb9c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, 0xa
xor edx, edx
div ecx
mov edi, eax
cmp edi, 0x3e8
jae 0x61fb73
mov edi, 0x3e8
jmp 0x61fb80
cmp edi, 0x2710
jbe 0x61fb80
mov edi, 0x2710
push edi
call sub.KERNEL32.DLL_Sleep_2
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x61fba2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jb 0x61fba2
cmp dword [ebp - 0x24], 1
jne 0x61fb50
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x24], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fbd7
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a9a4
ret
Function at 0x61fbe0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa28
mov eax, dword [ebp - 8]
call fcn.0040aa28
xor eax, eax
push ebp
push 0x61fcec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x28], 1
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040b7cc
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x61fcca
push 0x14
mov eax, dword [ebp - 8]
call fcn.0040b7cc
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x61fcc4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x61fcbe
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x61fcbe
jmp 0x61fcb8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0xa
xor edx, edx
div ecx
mov edi, eax
cmp edi, 0x3e8
jae 0x61fc8f
mov edi, 0x3e8
jmp 0x61fc9c
cmp edi, 0x2710
jbe 0x61fc9c
mov edi, 0x2710
push edi
call sub.KERNEL32.DLL_Sleep_2
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x61fcbe
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x61fcbe
cmp dword [ebp - 0x28], 4
jne 0x61fc6c
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61fcf3
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a9a4
ret
Function at 0x61fd4c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040aa28
xor eax, eax
push ebp
push 0x61ff11
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov eax, 2
call fcn.0061d288
mov esi, eax
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
mov eax, esi
call fcn.0061d2a8
mov ebx, eax
jmp 0x61fedd
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x214]
mov ecx, 0x104
call fcn.0040b870
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.004256bc
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.00423dfc
mov eax, dword [ebp - 0x23c]
push eax
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 4]
call fcn.00423dfc
mov edx, dword [ebp - 0x248]
pop eax
call fcn.0040bb58
je 0x61fe73
lea eax, [ebp - 0x250]
lea edx, [ebp - 0x214]
mov ecx, 0x104
call fcn.0040b870
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.00423dfc
mov eax, dword [ebp - 0x24c]
push eax
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.00423dfc
mov edx, dword [ebp - 0x254]
pop eax
call fcn.0040bb58
jne 0x61fece
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x100001
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
test edi, edi
je 0x61fec6
push 1
push edi
call sub.KERNEL32.DLL_TerminateProcess
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x61feb8
push 3
push edi
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x61fec0
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
jmp 0x61fec0
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xc], eax
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x61fee5
lea edx, [ebp - 0x238]
mov eax, esi
call fcn.0061d2c8
mov ebx, eax
test ebx, ebx
jne 0x61fdce
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61ff18
lea eax, [ebp - 0x254]
mov edx, 7
call fcn.0040a9a4
lea eax, [ebp - 4]
call fcn.0040a944
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret