joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db20c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db3ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004d5a38
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x5608c4], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5608c8], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5608cc], eax
mov eax, dword [0x562600]
cmp dword [eax], 2
sete byte [0x560090]
push 0x4db3f8
call sub.kernel32.dll_GetModuleHandleW_2
lea edx, [ebp - 4]
call fcn.004d3638
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x560090], 0
jne 0x4db29b
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004d3cbc
test al, al
je 0x4db29b
mov eax, dword [ebp - 0x4c]
mov dword [0x56890c], eax
jmp 0x4db2a2
xor eax, eax
mov dword [0x56890c], eax
call fcn.004daaa4
and eax, 0x7f
cmp eax, 0x12
ja case.0x4db2b3.0
jmp dword [eax*4 + 0x4db2ba]
mov byte [0x56007c], 1
jmp case.0x4db2b3.0
mov byte [0x560080], 1
jmp case.0x4db2b3.0
mov byte [0x560084], 1
jmp case.0x4db2b3.0
mov byte [0x560088], 1
jmp case.0x4db2b3.0
mov byte [0x56008c], 1
jmp case.0x4db2b3.0
mov byte [0x560094], 1
mov byte [0x560098], 1
jmp case.0x4db2b3.0
mov byte [0x560094], 1
mov byte [0x56009c], 1
jmp case.0x4db2b3.0
mov byte [0x560094], 1
mov byte [0x56009c], 1
mov byte [0x5600a0], 1
jmp case.0x4db2b3.0
mov byte [0x5600a4], 1
jmp case.0x4db2b3.0
mov byte [0x5600a8], 1
jmp case.0x4db2b3.0
mov byte [0x5600ac], 1
jmp case.0x4db2b3.0
mov byte [0x5600b0], 1
jmp case.0x4db2b3.0
mov byte [0x5600b4], 1
jmp case.0x4db2b3.0
mov byte [0x5600b8], 1
jmp case.0x4db2b3.0
mov byte [0x5600bc], 1
jmp case.0x4db2b3.0
mov byte [0x5600c0], 1
jmp case.0x4db2b3.0
mov byte [0x5600c4], 1
jmp case.0x4db2b3.0
mov byte [0x5600c8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db3f3
lea eax, [ebp - 4]
call fcn.00407798
ret

Function at 0x4de330
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x4de394
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00407990
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00414700
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de39b
lea eax, [ebp - 0x14]
call fcn.00407798
ret
Function at 0x4e2664
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4e2679
add esp, 0xfffffff0
call fcn.00405b3c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.004055d8
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004077a8
mov eax, esi
call fcn.00407834
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexW_1
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4e26cd
mov ecx, dword [0x5623ac]
mov dl, 1
mov eax, dword [0x4e2204]
call fcn.004cb1d0
call fcn.004060e0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4e26f4
call fcn.00405b94
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4ed524
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ed615
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4ed624
push esi
call sub.kernel32.dll_FindResourceW
test eax, eax
setne al
mov byte [ebx + 4], al
cmp byte [ebx + 4], 0
je 0x4ed5b5
push 0x4ed4d4
lea ecx, [ebx + 0x14]
mov edx, ebx
mov eax, esi
call fcn.0041dc98
cmp dword [ebx + 0xc], 0
jne 0x4ed599
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004d3638
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004d350c
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
mov ecx, 0x4ed648
call fcn.00407c64
cmp byte [ebx + 0x1d], 0
je 0x4ed5b5
mov eax, dword [ebx + 8]
mov edx, dword [eax]
call dword [edx + 0xa0]
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 0xa0]
push 0xa
push 0x4ed654
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
je 0x4ed5fa
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ed5fa
push edi
push esi
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LockResource
lea ecx, [ebx + 0x18]
pop edx
call fcn.00408a24
lea eax, [ebx + 0x18]
call fcn.004def64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed61c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004077a0
ret

Function at 0x4ee05c
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ee09b
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4ee09b
cmp dword [eax + 0x3c], 0
je 0x4ee09b
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ee099
cmp dword [esi], 0x4550
je 0x4ee09b
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4ee0a0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ee0df
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x4ee0df
cmp dword [eax + 0x3c], 0
je 0x4ee0df
mov esi, dword [eax + 0x3c]
add esi, ebx
push 0x108
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x4ee0dd
cmp dword [esi], 0x4550
je 0x4ee0df
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4ff854
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ff918
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00415290
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4ff934
call fcn.00407c64
mov eax, dword [ebp - 4]
call fcn.00414cec
push 0
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00415564
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0xc]
call fcn.00407834
push eax
mov eax, ebx
call fcn.00407834
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x4ff8d4
mov eax, ebx
call fcn.00407834
push eax
call sub.kernel32.dll_DeleteFileW
push 0
mov eax, dword [esi + 0x30]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4ff8fd
mov eax, dword [esi + 0x2c]
push eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4fd888]
call fcn.004ff9ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff91f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004077a0
ret
Function at 0x5000c4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5001f8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bx, 0x5c
je 0x5001dd
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x500138
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00407914
lea eax, [ebp - 0x2c]
mov edx, 0x500214
call fcn.00407ba4
mov eax, dword [ebp - 0x2c]
call fcn.00407834
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call eax
jmp 0x500194
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.00407914
lea eax, [ebp - 0x30]
mov edx, 0x500214
call fcn.00407ba4
mov eax, dword [ebp - 0x30]
call fcn.00407834
push eax
call sub.kernel32.dll_GetDiskFreeSpaceW
test eax, eax
je 0x500194
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00408af8
call fcn.00408af8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x500228
lea eax, [ebp - 0x38]
mov edx, ebx
call fcn.00407914
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
mov eax, dword [0x4fdee0]
call fcn.0050131c
push dword [ebp - 0x34]
push 0x500238
push dword [ebp - 4]
push dword [ebp - 8]
lea edx, [ebp - 0x3c]
mov eax, dword [0x4fdee0]
call fcn.00501408
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00407d48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5001ff
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004077a0
ret
Function at 0x500be8
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push 0x104
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x500c1e
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00407990
jmp 0x500c27
mov eax, ebx
xor edx, edx
call fcn.004077a8
add esp, 0x20c
pop ebx
ret

Function at 0x500e18
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x500f04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x500f10
push 0x500f3c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040cf94
test eax, eax
je 0x500e5f
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call eax
jmp 0x500e85
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.00408b1c
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.00414674
push dword [ebp - 0x64]
push 0x500f64
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.00408b1c
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.00414674
push dword [ebp - 0x68]
push 0x500f74
mov eax, ebx
mov edx, 4
call fcn.00407d48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500f0b
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004077a0
ret

Function at 0x532c58
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, 0x40
call fcn.0040424c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00404c5c
xor eax, eax
push ebp
push 0x532ce3
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
mov byte [esi + 0x30], bl
movzx eax, byte [ebp + 8]
mov byte [esi + 2], al
movzx eax, byte [ebp - 1]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
movzx eax, byte [ebp - 2]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov byte [esi], 0x32
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_Netbios
movzx eax, byte [esi + 0x31]
mov byte [ebp - 3], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532cea
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.00404268
ret
Function at 0x5355c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc74
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x380], edx
mov dword [ebp - 0x384], edx
mov dword [ebp - 0x388], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x270]
mov edx, dword [0x40e7ec]
call fcn.00408544
xor eax, eax
push ebp
push 0x535818
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42fe60]
call fcn.0043c0fc
mov dword [ebp - 0x278], eax
mov eax, dword [0x561b80]
mov eax, dword [eax]
lea edx, [eax + 0x1282]
lea eax, [ebp - 0x37c]
call fcn.00404b40
mov edx, 0x535828
lea eax, [ebp - 0x37c]
mov cl, 0xfc
call fcn.00404b10
lea edx, [ebp - 0x37c]
lea eax, [ebp - 0x27c]
call fcn.00407af4
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x270]
mov edx, 0x1ff
call fcn.00414e84
test eax, eax
jne 0x5356bf
mov eax, dword [ebp - 0x25c]
mov edx, 0x535838
call fcn.00407e68
je 0x5356b0
mov eax, dword [ebp - 0x25c]
mov edx, 0x535848
call fcn.00407e68
je 0x5356b0
cmp dword [ebp - 0x260], 0x10
je 0x5356b0
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x270]
call fcn.00414ed4
test eax, eax
je 0x535672
mov edx, 0x53551c
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
call dword [ecx + 0xa4]
xor eax, eax
push ebp
push 0x5357c9
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x535784
lea eax, [ebp - 0x384]
mov edx, dword [0x561b80]
mov edx, dword [edx]
add edx, 0x1282
call fcn.00407af4
lea eax, [ebp - 0x384]
push eax
mov eax, dword [ebp - 0x278]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
lea ecx, [ebp - 0x388]
mov eax, dword [ebp - 0x278]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x388]
pop eax
call fcn.00407ba4
mov eax, dword [ebp - 0x384]
call fcn.00407834
mov edx, eax
lea eax, [ebp - 0x380]
call fcn.00407954
mov esi, dword [ebp - 0x380]
mov dword [ebp - 0x38c], esi
mov eax, dword [ebp - 0x38c]
call fcn.00407834
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x278]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x274]
call fcn.00535fb0
xor edx, edx
push edx
push eax
mov eax, dword [0x561b80]
mov eax, dword [eax]
mov eax, dword [eax + 0x1384]
shl eax, 0x14
cdq
cmp edx, dword [esp + 4]
jne 0x5357b7
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x5356e5
jmp 0x5357bf
pop edx
pop eax
jle 0x5356e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5357d3
mov eax, dword [ebp - 0x278]
call fcn.00405608
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53581f
lea eax, [ebp - 0x388]
mov edx, 3
call fcn.004077a0
lea eax, [ebp - 0x27c]
call fcn.00407798
lea eax, [ebp - 0x270]
mov edx, dword [0x40e7ec]
call fcn.0040861c
ret

Function at 0x536990
Capabilities:
Stop service

Disassembly:
push ebx
add esp, 0xffffffe4
mov ebx, eax
push esp
push 1
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x1c
pop ebx
ret
Function at 0x5369f4
Capabilities:
Query service status

Disassembly:
add esp, 0xffffffe4
push esp
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [esp + 4]
add esp, 0x1c
ret

Function at 0x538b38
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
push edi
test dl, dl
je 0x538b50
add esp, 0xfffffff0
call fcn.00405b3c
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x538bcd
push 0x80
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x538bc8
mov eax, dword [ebp - 4]
add eax, 0x60
lea edx, [ebp - 0x298]
mov ecx, 0x80
push 0
call fcn.00406c6c
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x538bc8
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x64
mov ecx, 0
call fcn.00406bc8
call sub.wsock32.dll_WSACleanup
push 0x538c7c
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], ebx
xor eax, eax
push ebp
push 0x538c22
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x538bf6
call fcn.0041df60
push 0x538c98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call fcn.0040cf94
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], ebx
test ebx, ebx
jne 0x538c18
call fcn.0041df60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x538c3d
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [eax + 0x58], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x5c], edx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0053996c
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x538c6e
call fcn.00405b94
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53a4c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd70
xor edx, edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x278]
mov edx, dword [0x40e7ec]
call fcn.00408544
xor eax, eax
push ebp
push 0x53a770
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x561b80]
mov edx, dword [edx]
add edx, 0x388
call fcn.00407af4
lea eax, [ebp - 0x27c]
mov ecx, 0x53a788
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00414e84
test eax, eax
jne 0x53a5c9
mov eax, dword [ebp - 0x264]
mov edx, 0x53a798
call fcn.00407e68
je 0x53a5af
mov eax, dword [ebp - 0x264]
mov edx, 0x53a7a8
call fcn.00407e68
je 0x53a5af
cmp dword [ebp - 0x26c], 0
jne 0x53a5af
cmp dword [ebp - 0x270], 0
jne 0x53a5af
lea eax, [ebp - 0x280]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x280]
call fcn.00407834
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.00414ed4
test eax, eax
je 0x53a554
lea eax, [ebp - 0x278]
call fcn.00414ef8
lea eax, [ebp - 4]
mov edx, dword [0x561b80]
mov edx, dword [edx]
add edx, 0x1282
call fcn.00407af4
lea eax, [ebp - 0x284]
mov ecx, 0x53a788
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x284]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00414e84
test eax, eax
jne 0x53a681
mov eax, dword [ebp - 0x264]
mov edx, 0x53a798
call fcn.00407e68
je 0x53a667
mov eax, dword [ebp - 0x264]
mov edx, 0x53a7a8
call fcn.00407e68
je 0x53a667
cmp dword [ebp - 0x26c], 0
jne 0x53a667
cmp dword [ebp - 0x270], 0
jne 0x53a667
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x288]
call fcn.00407834
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.00414ed4
test eax, eax
je 0x53a60c
lea eax, [ebp - 0x278]
call fcn.00414ef8
lea eax, [ebp - 4]
mov edx, dword [0x561b80]
mov edx, dword [edx]
add edx, 0x794
call fcn.00407af4
lea eax, [ebp - 0x28c]
mov ecx, 0x53a788
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x28c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00414e84
test eax, eax
jne 0x53a739
mov eax, dword [ebp - 0x264]
mov edx, 0x53a798
call fcn.00407e68
je 0x53a71f
mov eax, dword [ebp - 0x264]
mov edx, 0x53a7a8
call fcn.00407e68
je 0x53a71f
cmp dword [ebp - 0x26c], 0
jne 0x53a71f
cmp dword [ebp - 0x270], 0
jne 0x53a71f
lea eax, [ebp - 0x290]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00407c64
mov eax, dword [ebp - 0x290]
call fcn.00407834
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.00414ed4
test eax, eax
je 0x53a6c4
lea eax, [ebp - 0x278]
call fcn.00414ef8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a777
lea eax, [ebp - 0x290]
mov edx, 6
call fcn.004077a0
lea eax, [ebp - 0x278]
mov edx, dword [0x40e7ec]
call fcn.0040861c
lea eax, [ebp - 4]
call fcn.00407798
ret
Function at 0x53a7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x53a7f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x561aa8]
mov eax, dword [eax]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x53a7e9
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x53a814
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x53bc3c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x53bdf3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW_1
mov esi, eax
test esi, esi
jne 0x53bcad
push 0
push 0
push 2
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
call fcn.004fe39c
mov edx, 0x53be0c
pop ecx
call fcn.004fe604
push 2
push 1
push 0
call fcn.004fe39c
xor ecx, ecx
mov edx, 0x53be48
call fcn.004fe718
jmp 0x53bdd7
push 0xf01ff
push 0x53be68
push esi
call sub.advapi32.dll_OpenServiceW_1
mov ebx, eax
test ebx, ebx
jne 0x53bd0b
push 0
push 0
push 2
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
call fcn.004fe39c
mov edx, 0x53be0c
pop ecx
call fcn.004fe604
push esi
call sub.advapi32.dll_CloseServiceHandle_1
push 2
push 1
push 0
call fcn.004fe39c
xor ecx, ecx
mov edx, 0x53be88
call fcn.004fe718
jmp 0x53bdd7
push 1
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53bc00]
call fcn.0040916c
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x64
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov dword [ebp - 0x1c], 0xea60
mov eax, 0x53bea4
mov dword [ebp - 0x18], eax
mov eax, 0x53bea4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
jne 0x53bd8d
push 0
push 0
push 2
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
call fcn.004fe39c
mov edx, 0x53be0c
pop ecx
call fcn.004fe604
mov eax, 0x53bea8
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 1
push ebx
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
jne 0x53bdcb
push 0
push 0
push 2
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
call fcn.004fe39c
mov edx, 0x53bf04
pop ecx
call fcn.004fe604
push ebx
call sub.advapi32.dll_CloseServiceHandle_1
push esi
call sub.advapi32.dll_CloseServiceHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53bdfa
lea eax, [ebp - 4]
mov edx, dword [0x53bc00]
call fcn.00409178
ret