joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493cb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x493d21
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp + 8]
call fcn.00415f90
lea eax, [eax + eax + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
lea ecx, [ebp + 8]
call fcn.00415f60
push eax
mov edx, dword [ebp - 8]
push edx
call fcn.005282c4
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp + 8]
call fcn.00415e20
mov esp, ebp
pop ebp
ret

Function at 0x494010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x203
jne 0x4941a3
push 0x42b
mov ecx, dword [ebp - 0x224]
call fcn.004e7012
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp edx, dword [eax + 0x20]
jne 0x494063
mov dword [ebp - 8], 0
push 0x4ba
mov ecx, dword [ebp - 0x224]
call fcn.004e7012
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
cmp edx, dword [eax + 0x20]
jne 0x4941a3
mov eax, dword [ebp - 4]
and eax, 8
je 0x4940e5
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x208
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.005281f0
add esp, 0xc
push 0x5d9210
push 0x588fcc
lea eax, [ebp - 0x220]
push eax
call fcn.00527b98
add esp, 0xc
push 5
lea ecx, [ebp - 0x220]
push ecx
push 0
lea edx, [ebp - 0x220]
push edx
push 0x588fd4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4941a3
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x1114]
add eax, 1
cdq
mov ecx, 3
idiv ecx
mov eax, dword [ebp - 0x224]
mov dword [eax + 0x1114], edx
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + 0x1114]
neg edx
sbb edx, edx
and edx, 0xfffffffb
add edx, 5
push edx
mov ecx, dword [ebp - 0x224]
add ecx, 0x1214
call fcn.004e72f5
mov eax, dword [ebp - 0x224]
mov ecx, dword [eax + 0x1114]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffb
add ecx, 5
push ecx
mov ecx, dword [ebp - 0x224]
add ecx, 0x11c0
call fcn.004e72f5
mov edx, dword [ebp - 0x224]
xor eax, eax
cmp dword [edx + 0x1114], 2
setne al
sub eax, 1
and eax, 5
push eax
mov ecx, dword [ebp - 0x224]
add ecx, 0x116c
call fcn.004e72f5
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + 0x1114]
push edx
mov ecx, dword [ebp - 0x224]
add ecx, 0x1118
call fcn.004944b0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x224]
call fcn.00496260
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 4
Function at 0x495ec0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x474], 0
mov dword [ebp - 4], 0
push 0x10
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.005281f0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x468]
push ecx
call fcn.005281f0
add esp, 0xc
mov dword [ebp - 0x468], 0x44
lea edx, [ebp - 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x14], 0
je 0x495fd5
cmp dword [ebp + 0xc], 0
je 0x495f4d
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x478], edx
jmp 0x495f82
lea eax, [ebp - 0x46c]
push eax
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x474]
or ecx, 1
mov dword [ebp - 0x474], ecx
mov ecx, dword [ebp - 0x47c]
call fcn.00415f60
mov dword [ebp - 0x478], eax
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x478]
push ecx
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x474]
and eax, 1
je 0x495fd0
and dword [ebp - 0x474], 0xfffffffe
lea ecx, [ebp - 0x46c]
call fcn.00415e20
jmp 0x49606c
cmp dword [ebp + 0xc], 0
je 0x495fe6
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x480], ecx
jmp 0x49601b
lea edx, [ebp - 0x470]
push edx
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x474]
or eax, 2
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x484]
call fcn.00415f60
mov dword [ebp - 0x480], eax
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x480]
push eax
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0x408]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x474]
and edx, 2
je 0x49606c
and dword [ebp - 0x474], 0xfffffffd
lea ecx, [ebp - 0x470]
call fcn.00415e20
mov dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
je 0x49608b
push 0xffffffffffffffff
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4960b2
mov eax, 1
jmp 0x4960b4
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret
Function at 0x496b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a4a5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x203
jne 0x496c25
push 5
push 0
push 0
push 0x589854
lea eax, [ebp - 0x10]
push eax
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00411930
add esp, 0xc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.00415f60
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.00415e20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00415e20
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004e0ac7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4975a0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a5a7
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 8], 0x83e7
jne 0x4975e4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x114], ecx
xor eax, eax
jmp 0x497731
cmp dword [ebp + 8], 0x7e7
jne 0x49761e
mov edx, dword [ebp - 0x30]
add edx, 0x2a8
push edx
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0x158]
call eax
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
jmp 0x497731
cmp dword [ebp + 8], 0x46e
jne 0x49771d
cmp dword [ebp + 0x10], 0x201
jne 0x49765c
mov ecx, dword [ebp - 0x30]
call fcn.0043b050
mov ecx, dword [ebp - 0x30]
call fcn.0043b010
test eax, eax
je 0x497652
push 9
mov ecx, dword [ebp - 0x30]
call fcn.004e72f5
push 5
mov ecx, dword [ebp - 0x30]
call fcn.004e72f5
cmp dword [ebp + 0x10], 0x204
jne 0x49771d
lea ecx, [ebp - 0x14]
call fcn.00446940
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0x1c]
call fcn.004942b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
call fcn.0043b050
push 0x80
lea ecx, [ebp - 0x1c]
call fcn.004943a0
test eax, eax
je 0x49770e
lea edx, [ebp - 0x1c]
push edx
call fcn.0049aa90
add esp, 4
push 0
lea ecx, [ebp - 0x1c]
call fcn.00494370
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4976e4
mov ecx, dword [ebp - 0x20]
call fcn.004e719e
and eax, 0x40000000
je 0x4976e4
mov ecx, dword [ebp - 0x20]
call fcn.00415300
mov dword [ebp - 0x20], eax
jmp 0x4976c2
lea ecx, [ebp - 0x28]
call fcn.00446940
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
push 2
mov ecx, dword [ebp - 0x2c]
call fcn.004e18ed
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00494310
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.00496b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x498530
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a6c6
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x82c], ecx
xor eax, eax
mov word [ebp - 0x814], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x812]
push ecx
call fcn.005281f0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x498591
mov edx, dword [ebp + 8]
mov dword [ebp - 0x830], edx
jmp 0x49859b
mov dword [ebp - 0x830], 0x589cc4
push 0x589cb4
call fcn.0043d000
push eax
push 0x589cc0
lea eax, [ebp - 0x81c]
push eax
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x834]
mov dword [ebp - 0x838], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x838]
push edx
lea eax, [ebp - 0x820]
push eax
call fcn.00411930
add esp, 0xc
mov dword [ebp - 0x83c], eax
mov ecx, dword [ebp - 0x83c]
mov dword [ebp - 0x840], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x840]
push edx
lea eax, [ebp - 0x824]
push eax
call fcn.00411930
add esp, 0xc
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x844]
mov dword [ebp - 0x848], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x848]
push edx
lea eax, [ebp - 0x828]
push eax
call fcn.00411930
add esp, 0xc
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x84c]
call fcn.00415f60
push eax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
mov edx, dword [ebp - 0x830]
push edx
push str.MainWindow
push str.ListWidth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x828]
call fcn.00415e20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x824]
call fcn.00415e20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x820]
call fcn.00415e20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.00415e20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x10]
push ecx
push str._d__d
lea edx, [ebp - 0x814]
push edx
call fcn.00528085
add esp, 0x10
push 2
mov eax, dword [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
push 0
mov ecx, dword [ebp - 0x82c]
call fcn.004e766d
push 0
mov ecx, dword [ebp - 0x82c]
call fcn.004e288a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 4
Function at 0x49a130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56aa69
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.005281f0
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
push ecx
lea ecx, [ebp - 0x418]
call fcn.00435ea0
mov dword [ebp - 0x42c], eax
mov edx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x430]
call fcn.00496e30
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x41c]
push edx
call fcn.00499e00
add esp, 8
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x438], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x438]
call fcn.00412150
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.00499e00
add esp, 8
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x440]
call fcn.00412150
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x424]
call fcn.00435ea0
mov dword [ebp - 0x444], eax
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x448], edx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x448]
call fcn.00496e30
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x424]
call fcn.00435f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x420]
call fcn.00412130
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x41c]
call fcn.00412130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.00435f40
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x428]
push edx
call fcn.00499f50
add esp, 8
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0x44c]
call fcn.00415f60
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0052a496
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.00415e20
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00528324
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret
Function at 0x49a310
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56aaa9
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
add eax, 1
push eax
call fcn.004dea4c
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.005281f0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00435ea0
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
call fcn.00496e30
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00435ea0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
call fcn.00496e30
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00435f40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00435f40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x49a3ee
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jge 0x49a491
lea ecx, [ebp - 0x20]
call fcn.0046e6b0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0046e860
lea ecx, [ebp - 0x20]
call fcn.00425460
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x20]
call fcn.00412150
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00499f50
add esp, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.00415f60
push eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx*2]
push ecx
call fcn.005282c4
add esp, 8
lea ecx, [ebp - 0x30]
call fcn.00415e20
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx*2]
push ecx
call fcn.00528324
add esp, 4
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00412130
jmp 0x49a3e5
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.004dea57
add esp, 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x49f410
Capabilities:
Create service
Delete service
Persist via windows service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2044
call fcn.00528110
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2044], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x2014], eax
cmp dword [ebp - 0x2014], 0
je 0x49f538
push 0xf01ff
mov eax, dword [ebp - 0x2044]
add eax, 0x42c
push eax
mov ecx, dword [ebp - 0x2014]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2018], eax
cmp dword [ebp - 0x2018], 0
je 0x49f515
lea edx, [ebp - 0x2038]
push edx
push 1
mov eax, dword [ebp - 0x2018]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x49f4df
lea ecx, [ebp - 0x2038]
push ecx
mov edx, dword [ebp - 0x2018]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x49f4cc
cmp dword [ebp - 0x2034], 3
jne 0x49f4c8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x49f4ca
jmp 0x49f4cc
jmp 0x49f49a
cmp dword [ebp - 0x2034], 1
je 0x49f4df
mov dword [ebp - 0x201c], 0
mov eax, dword [ebp - 0x2018]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x49f4fc
mov dword [ebp - 0x203c], 1
jmp 0x49f506
mov dword [ebp - 0x2040], 0
mov ecx, dword [ebp - 0x2018]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x49f51f
mov dword [ebp - 0x201c], 1
mov edx, dword [ebp - 0x2014]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x201c], 1
jmp 0x49f542
mov dword [ebp - 0x201c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0x200c], 0
jne 0x49f567
xor eax, eax
jmp 0x49f626
push 0x7d0
lea eax, [ebp - 0x2008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x49f586
xor eax, eax
jmp 0x49f626
push 0x58aca0
lea ecx, [ebp - 0x2008]
push ecx
push str.__s___s
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov ecx, dword [ebp - 0x2044]
add ecx, 0x2c
push ecx
mov edx, dword [ebp - 0x2044]
add edx, 0x42c
push edx
mov eax, dword [ebp - 0x200c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x2010], eax
cmp dword [ebp - 0x2010], 0
jne 0x49f607
mov ecx, dword [ebp - 0x200c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x49f626
mov edx, dword [ebp - 0x2010]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x200c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret
Function at 0x49f640
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49f714
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 0x42c
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49f6fa
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x49f6d0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x49f6c3
cmp dword [ebp - 0x24], 3
jne 0x49f6bf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x49f6c1
jmp 0x49f6c3
jmp 0x49f69a
cmp dword [ebp - 0x24], 1
je 0x49f6d0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x49f6e7
mov dword [ebp - 0x2c], 1
jmp 0x49f6ee
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x49f701
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0xc], 1
jmp 0x49f71b
mov dword [ebp - 0xc], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x49f730
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 2
jne 0x49f752
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0
jmp 0x49f784
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
cmp edx, 5
jg 0x49f77a
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0x27
jmp 0x49f784
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], 0x127
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x24], ecx
cmp dword [ebp + 8], 4
je 0x49f7ab
cmp dword [ebp + 8], 1
jne 0x49f7b7
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], 0
jmp 0x49f7d2
mov eax, dword [ebp - 8]
mov ecx, dword [0x5c3ddc]
mov dword [eax + 0x20], ecx
mov edx, dword [0x5c3ddc]
add edx, 1
mov dword [0x5c3ddc], edx
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49fcb0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49fcd5
xor al, al
jmp 0x49fd6e
push 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49fd15
push 4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49fd15
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x49fd6e
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x49fd4c
cmp dword [ebp - 0x20], 2
jne 0x49fd48
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x49fd4a
jmp 0x49fd4c
jmp 0x49fd23
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20], 4
jne 0x49fd6c
mov al, 1
jmp 0x49fd6e
xor al, al
mov esp, ebp
pop ebp
ret