joyce8/EMBER2024-capa huggingface dataset:
Function at 0x618d09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ecx
push edi
add esp, 4
add ecx, 0x159bd
or ecx, 0x105b5
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x618356
push esi
push eax
add esp, 4
jmp 0x618363
add esi, 0x12400
pop esi
push ebx
push eax
add esp, 4
call 0x61837c
add byte [esi], dh
xor al, byte [eax + 0x4b]
inc ecx
inc eax
xor eax, dword [ebx + 0x565b04c4]
or esi, 0x1146f
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x618c8d
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
mov ecx, 0x65
mov word [ebp - 0x16e6], cx
mov edx, 0x72
mov word [ebp - 0x16e4], dx
mov eax, 0x6e
mov word [ebp - 0x16e2], ax
mov ecx, 0x65
mov word [ebp - 0x16e0], cx
mov edx, 0x6c
mov word [ebp - 0x16de], dx
mov eax, 0x33
mov word [ebp - 0x16dc], ax
mov ecx, 0x32
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push edi
push edx
add esp, 4
call 0x618441
add byte [esp + esi + 0x44], cl
inc esp
cmp eax, 0x83434248
les eax, [ecx + eax*4]
invalid
fsubr st(1)
invalid
push ebx
push ebx
add esp, 4
call 0x618ca1
add byte [esi + 0x3d], cl
cmp edi, dword [ebx]
dec esi
xor al, 0x40
cmp eax, dword [ebx - 0x347efb3c]
fisubr word [eax - 0x1c7f0000]
jno 0x618c3d
add byte [eax], al
or ebx, 0x143fc
pop ebx
push ebx
sub ebx, 0xb3e8
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push esi
xor esi, 0xc54e
add esi, 0x108e
or esi, 0x89ea
call 0x618d09
add byte [esi + 0x43], cl
aas
cmp byte [edi + ecx*2 + 0x36], al
add esp, 4
pop esi
push eax
push esi
add esp, 4
or eax, 0x16c4c
pop eax
cmp dword [ebp - 0x1574], 0
jne 0x618d31
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push eax
add eax, 0x5121
call 0x618d57
add byte [edx + 0x46], cl
cmp al, 0x34
dec edi
inc ecx
aas
add esp, 4
pop eax
push ebx
xor ebx, 0xeacf
xor ebx, 0xe83a
add ebx, 0x505a
sub ebx, 0xd391
pop ebx
cmp dword [ebp - 0xc68], 0
jne 0x618d8d
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push eax
call 0x618da7
add byte [0x343c4b4a], dh
dec ebx
cmp dword [ebx - 0x377efb3c], eax
in eax, dx
add eax, dword [eax]
add byte [eax + 0x51], bl
push edi
add esp, 4
add ecx, 0x6e3a
pop ecx
push eax
xor eax, 0xd0ce
sub eax, 0x3b0f
pop eax
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
Function at 0x618d57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ecx
push edi
add esp, 4
add ecx, 0x159bd
or ecx, 0x105b5
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x618356
push esi
push eax
add esp, 4
jmp 0x618363
add esi, 0x12400
pop esi
push ebx
push eax
add esp, 4
call 0x61837c
add byte [esi], dh
xor al, byte [eax + 0x4b]
inc ecx
inc eax
xor eax, dword [ebx + 0x565b04c4]
or esi, 0x1146f
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x618c8d
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
mov ecx, 0x65
mov word [ebp - 0x16e6], cx
mov edx, 0x72
mov word [ebp - 0x16e4], dx
mov eax, 0x6e
mov word [ebp - 0x16e2], ax
mov ecx, 0x65
mov word [ebp - 0x16e0], cx
mov edx, 0x6c
mov word [ebp - 0x16de], dx
mov eax, 0x33
mov word [ebp - 0x16dc], ax
mov ecx, 0x32
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push edi
push edx
add esp, 4
call 0x618441
add byte [esp + esi + 0x44], cl
inc esp
cmp eax, 0x83434248
les eax, [ecx + eax*4]
invalid
fsubr st(1)
invalid
push ebx
push ebx
add esp, 4
call 0x618ca1
add byte [esi + 0x3d], cl
cmp edi, dword [ebx]
dec esi
xor al, 0x40
cmp eax, dword [ebx - 0x347efb3c]
fisubr word [eax - 0x1c7f0000]
jno 0x618c3d
add byte [eax], al
or ebx, 0x143fc
pop ebx
push ebx
sub ebx, 0xb3e8
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push esi
xor esi, 0xc54e
add esi, 0x108e
or esi, 0x89ea
call 0x618d09
add byte [esi + 0x43], cl
aas
cmp byte [edi + ecx*2 + 0x36], al
add esp, 4
pop esi
push eax
push esi
add esp, 4
or eax, 0x16c4c
pop eax
cmp dword [ebp - 0x1574], 0
jne 0x618d31
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push eax
add eax, 0x5121
call 0x618d57
add byte [edx + 0x46], cl
cmp al, 0x34
dec edi
inc ecx
aas
add esp, 4
pop eax
push ebx
xor ebx, 0xeacf
xor ebx, 0xe83a
add ebx, 0x505a
sub ebx, 0xd391
pop ebx
cmp dword [ebp - 0xc68], 0
jne 0x618d8d
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push eax
call 0x618da7
add byte [0x343c4b4a], dh
dec ebx
cmp dword [ebx - 0x377efb3c], eax
in eax, dx
add eax, dword [eax]
add byte [eax + 0x51], bl
push edi
add esp, 4
add ecx, 0x6e3a
pop ecx
push eax
xor eax, 0xd0ce
sub eax, 0x3b0f
pop eax
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
Function at 0x618da7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push ecx
push edi
add esp, 4
add ecx, 0x159bd
or ecx, 0x105b5
pop ecx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x618356
push esi
push eax
add esp, 4
jmp 0x618363
add esi, 0x12400
pop esi
push ebx
push eax
add esp, 4
call 0x61837c
add byte [esi], dh
xor al, byte [eax + 0x4b]
inc ecx
inc eax
xor eax, dword [ebx + 0x565b04c4]
or esi, 0x1146f
pop esi
cmp dword [ebp - 0x2a8], 0
jne 0x618c8d
mov eax, 0x6b
mov word [ebp - 0x16e8], ax
mov ecx, 0x65
mov word [ebp - 0x16e6], cx
mov edx, 0x72
mov word [ebp - 0x16e4], dx
mov eax, 0x6e
mov word [ebp - 0x16e2], ax
mov ecx, 0x65
mov word [ebp - 0x16e0], cx
mov edx, 0x6c
mov word [ebp - 0x16de], dx
mov eax, 0x33
mov word [ebp - 0x16dc], ax
mov ecx, 0x32
mov word [ebp - 0x16da], cx
mov edx, 0x2e
mov word [ebp - 0x16d8], dx
mov eax, 0x64
mov word [ebp - 0x16d6], ax
mov ecx, 0x6c
mov word [ebp - 0x16d4], cx
mov edx, 0x6c
mov word [ebp - 0x16d2], dx
xor eax, eax
mov word [ebp - 0x16d0], ax
push edi
push edx
add esp, 4
call 0x618441
add byte [esp + esi + 0x44], cl
inc esp
cmp eax, 0x83434248
les eax, [ecx + eax*4]
invalid
fsubr st(1)
invalid
push ebx
push ebx
add esp, 4
call 0x618ca1
add byte [esi + 0x3d], cl
cmp edi, dword [ebx]
dec esi
xor al, 0x40
cmp eax, dword [ebx - 0x347efb3c]
fisubr word [eax - 0x1c7f0000]
jno 0x618c3d
add byte [eax], al
or ebx, 0x143fc
pop ebx
push ebx
sub ebx, 0xb3e8
pop ebx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x18fc], eax
mov ecx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1574], ecx
push esi
xor esi, 0xc54e
add esi, 0x108e
or esi, 0x89ea
call 0x618d09
add byte [esi + 0x43], cl
aas
cmp byte [edi + ecx*2 + 0x36], al
add esp, 4
pop esi
push eax
push esi
add esp, 4
or eax, 0x16c4c
pop eax
cmp dword [ebp - 0x1574], 0
jne 0x618d31
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0x1574]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc68], ecx
push eax
add eax, 0x5121
call 0x618d57
add byte [edx + 0x46], cl
cmp al, 0x34
dec edi
inc ecx
aas
add esp, 4
pop eax
push ebx
xor ebx, 0xeacf
xor ebx, 0xe83a
add ebx, 0x505a
sub ebx, 0xd391
pop ebx
cmp dword [ebp - 0xc68], 0
jne 0x618d8d
mov dword [ebp - 0x2a8], 0
jmp fcn.00618fd8
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push eax
call 0x618da7
add byte [0x343c4b4a], dh
dec ebx
cmp dword [ebx - 0x377efb3c], eax
in eax, dx
add eax, dword [eax]
add byte [eax + 0x51], bl
push edi
add esp, 4
add ecx, 0x6e3a
pop ecx
push eax
xor eax, 0xd0ce
sub eax, 0x3b0f
pop eax
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
Function at 0x618e0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x618e0a
add byte [edx], bh
dec ebp
inc esp
dec ebp
inc esi
cmp dword [eax + 0x36], edx
aaa
add esp, 4
and eax, 0x56fa
call 0x618e23
add byte [edi + esi + 0x48], cl
dec edx
inc ebp
aaa
dec edx
inc ebx
inc esi
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
push ebx
add esp, 4
or edi, 0x524f
pop edi
push edx
and edx, 0xc748
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x618ecd
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x618f27
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x618df5
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x618df5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x618f11
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x618f1b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x618f70
push edx
push ebx
add esp, 4
xor edx, 0x15172
and edx, 0x24fb
sub edx, 0x44db
pop edx
push edx
xor edx, 0x4c28
add edx, 0x13897
pop edx
push edi
push eax
add esp, 4
or edi, 0x3293
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp fcn.00618fd8
push edx
xor edx, 0xce3a
and edx, 0x1682c
jmp 0x618f83
or edx, 0x1468d
pop edx
push eax
call 0x618f99
add byte [ebx], dh
cmp bh, byte [0x453e3b33]
xor eax, 0xeb04c483
add esi, dword [eax + ecx*2]
xor eax, 0x14858b58
sti
invalid
Function at 0x618e23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x618e0a
add byte [edx], bh
dec ebp
inc esp
dec ebp
inc esi
cmp dword [eax + 0x36], edx
aaa
add esp, 4
and eax, 0x56fa
call 0x618e23
add byte [edi + esi + 0x48], cl
dec edx
inc ebp
aaa
dec edx
inc ebx
inc esi
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
push ebx
add esp, 4
or edi, 0x524f
pop edi
push edx
and edx, 0xc748
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x618ecd
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x618f27
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x618df5
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x618df5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x618f11
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x618f1b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x618f70
push edx
push ebx
add esp, 4
xor edx, 0x15172
and edx, 0x24fb
sub edx, 0x44db
pop edx
push edx
xor edx, 0x4c28
add edx, 0x13897
pop edx
push edi
push eax
add esp, 4
or edi, 0x3293
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp fcn.00618fd8
push edx
xor edx, 0xce3a
and edx, 0x1682c
jmp 0x618f83
or edx, 0x1468d
pop edx
push eax
call 0x618f99
add byte [ebx], dh
cmp bh, byte [0x453e3b33]
xor eax, 0xeb04c483
add esi, dword [eax + ecx*2]
xor eax, 0x14858b58
sti
invalid
Function at 0x618f99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
add esp, 4
call 0x618e0a
add byte [edx], bh
dec ebp
inc esp
dec ebp
inc esi
cmp dword [eax + 0x36], edx
aaa
add esp, 4
and eax, 0x56fa
call 0x618e23
add byte [edi + esi + 0x48], cl
dec edx
inc ebp
aaa
dec edx
inc ebx
inc esi
add esp, 4
pop eax
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
inc ebp
rcl byte [eax + 0x56], 0x83
les eax, [ecx + eax*4]
enter 0x2cca, 1
add byte [ecx + 0x13068c8], al
add byte [ecx + 0x15806c0], al
add byte [ecx + 0x13172c8], al
add byte [eax + 0x57], bl
push ebx
add esp, 4
or edi, 0x524f
pop edi
push edx
and edx, 0xc748
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x618ecd
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x618f27
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x618df5
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x618df5
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x618f11
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x618f1b
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x618f70
push edx
push ebx
add esp, 4
xor edx, 0x15172
and edx, 0x24fb
sub edx, 0x44db
pop edx
push edx
xor edx, 0x4c28
add edx, 0x13897
pop edx
push edi
push eax
add esp, 4
or edi, 0x3293
pop edi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp fcn.00618fd8
push edx
xor edx, 0xce3a
and edx, 0x1682c
jmp 0x618f83
or edx, 0x1468d
pop edx
push eax
call 0x618f99
add byte [ebx], dh
cmp bh, byte [0x453e3b33]
xor eax, 0xeb04c483
add esi, dword [eax + ecx*2]
xor eax, 0x14858b58
sti
invalid
Function at 0x6373b4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x108], 2
jne 0x6373f7
cmp dword [ebp - 0x114], 5
ja 0x6373fb
cmp dword [ebp - 0x114], 5
jne 0x6373f7
cmp dword [ebp - 0x110], 1
jae 0x6373fb
xor eax, eax
jmp 0x6373fd
mov al, 1
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x638d34
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x108], 2
jne 0x638d77
cmp dword [ebp - 0x114], 5
ja 0x638d7b
cmp dword [ebp - 0x114], 5
jne 0x638d77
cmp dword [ebp - 0x110], 1
jae 0x638d7b
xor eax, eax
jmp 0x638d7d
mov al, 1
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x642c0c
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x43fabc]
call fcn.0044e4bc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x642d82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x642c4f
cmp dword [ebp - 0xc], 0xffffffff
jne 0x642c54
call fcn.0042a870
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x40000
xor eax, eax
push ebp
push 0x642d65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.004045a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x642d2d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0x30
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_EnumServicesStatusExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x642d17
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
imul eax, dword [ebp - 0x24], 0xb
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + eax*4 + 0x24]
mov eax, dword [ebp - 4]
call fcn.00642e38
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x642d0f
mov eax, dword [ebp - 0x28]
add eax, 0x10
imul edx, dword [ebp - 0x24], 0xb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + edx*4]
call fcn.00407bbc
mov eax, dword [ebp - 0x28]
add eax, 0x14
imul edx, dword [ebp - 0x24], 0xb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + edx*4 + 4]
call fcn.00407bbc
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x642cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642d34
mov eax, dword [ebp - 0x10]
call fcn.004045c4
ret
Function at 0x64611c
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00406e54
mov eax, dword [ebp - 0xc]
call fcn.00406e54
mov eax, dword [ebp + 8]
call fcn.00406e54
xor eax, eax
push ebp
push 0x6462a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6462c8
mov eax, dword [ebp - 4]
call fcn.0064636c
mov byte [ebp - 0xd], 0
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x646193
xor ecx, ecx
mov edx, 0x6462e4
mov eax, dword [ebp - 4]
call fcn.00645e28
mov byte [ebp - 0xd], al
jmp 0x64627d
xor eax, eax
push ebp
push 0x646276
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x646300
mov eax, dword [ebp - 8]
call fcn.00407b54
push eax
push 1
push 2
push 0x10
push 0xf0002
mov eax, dword [ebp - 0xc]
call fcn.00407b54
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407b54
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateServiceW_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x646202
xor ecx, ecx
mov edx, 0x646318
mov eax, dword [ebp - 4]
call fcn.00645e28
mov byte [ebp - 0xd], al
call fcn.0040653c
jmp 0x64627d
xor eax, eax
push ebp
push 0x646258
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00407b54
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ChangeServiceConfig2W
test eax, eax
jne 0x64623d
xor ecx, ecx
mov edx, 0x646340
mov eax, dword [ebp - 4]
call fcn.00645e28
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64625f
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6462af
lea eax, [ebp - 0x24]
call fcn.00406d70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406dd0
lea eax, [ebp + 8]
call fcn.00406d70
ret
Function at 0x646a00
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x646b8a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x646ba4
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x646c1c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00407e48
mov eax, dword [ebp - 0x14]
call fcn.0053f35c
mov edx, 0x646c30
mov eax, dword [ebp - 4]
call fcn.0064636c
mov byte [ebp - 5], 0
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00407b54
push eax
call sub.advapi32.dll_OpenSCManagerW_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
ja 0x646a8a
xor ecx, ecx
mov edx, 0x646c50
mov eax, dword [ebp - 4]
call fcn.00645e28
mov byte [ebp - 5], al
jmp 0x646b6f
xor eax, eax
push ebp
push 0x646b68
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407b54
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
ja 0x646ad7
xor ecx, ecx
mov edx, 0x646c78
mov eax, dword [ebp - 4]
call fcn.00645e28
mov byte [ebp - 5], al
call fcn.0040653c
jmp 0x646b6f
xor eax, eax
push ebp
push 0x646b4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x646b24
push 0x646c9c
mov eax, dword [ebp - 4]
push dword [eax + 4]
push 0x646cfc
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00407e48
mov eax, dword [ebp - 0x18]
call fcn.0053f35c
jmp 0x646b33
xor ecx, ecx
mov edx, 0x646d40
mov eax, dword [ebp - 4]
call fcn.00645e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646b51
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x646b91
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00406dd0
ret