joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e8498
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6e84cb
dec al
je 0x6e850d
dec al
je 0x6e854f
dec al
je 0x6e85c4
jmp 0x6e865d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6e865d
inc edi
mov eax, esi
sub eax, dword [ebx + 0x24]
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx eax, byte [edx + eax]
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6e84db
jmp 0x6e865d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6e865d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6e851d
jmp 0x6e865d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6e865d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
mov edx, esi
dec edx
cmp eax, edx
jbe 0x6e8584
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x6e8598
mov eax, esi
sub eax, dword [ebx + 0x24]
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx eax, byte [edx + eax]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx edx, byte [eax + esi]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
sar ecx, 1
jns 0x6e85b1
adc ecx, 0
add dl, cl
and dl, 0xff
push edx
pop edx
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6e855f
jmp 0x6e865d
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6e865d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
mov edx, esi
dec edx
cmp eax, edx
ja 0x6e8629
mov eax, esi
sub eax, dword [ebx + 0x24]
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx eax, byte [edx + eax]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx eax, byte [eax + edx]
mov dword [ebp - 0x10], eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp - 0x10]
movzx edx, byte [ebp - 0xc]
movzx eax, byte [ebp - 8]
call fcn.006e5254
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [ebp - 4]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6e85de
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6f76e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x6f7735
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x6f771c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x6f770c
jmp 0x6f7735
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x6f771d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x72025c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x72028a
mov eax, ebx
call fcn.00720d18
cmp dword [ebx + 0x40], 0
je 0x720283
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x7202fb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x7202ed
cmp dword [ebx + 8], 0
je 0x7202ac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x7202be
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x7202ed
cmp dword [ebx + 8], 0
je 0x72029f
cmp eax, 3
je 0x7202d1
dec eax
jne 0x72029f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x72029f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x72029f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x720319
cmp dword [ebx + 0x14], 0xcc
je 0x720319
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00720324
pop ebx
ret

Function at 0x7356e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x7356f8
add esp, 0xfffffff0
call fcn.00408820
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x735812
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.00406ec4
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x7357fc
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.0052df48
xor eax, eax
push ebp
push 0x7357e9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0052df48
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040af1c
jmp 0x7357ba
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0040b248
mov eax, dword [ebx + 4]
call fcn.0040a4b8
dec eax
jle 0x7357ce
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x7357a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7357f0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x735819
lea eax, [ebp - 4]
call fcn.0040a008
ret
Function at 0x73c3a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
mov eax, dword [ebp + 0xc]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x73c49d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x41], 0x3c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x39], eax
mov dword [ebp - 0x3d], 0x40
test bl, bl
je 0x73c3ef
mov eax, 0x73c4ac
mov dword [ebp - 0x35], eax
jmp 0x73c3f7
mov eax, 0x73c4b8
mov dword [ebp - 0x35], eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
mov dword [ebp - 0x31], eax
mov eax, dword [ebp + 0xc]
call fcn.0040ae24
mov dword [ebp - 0x2d], eax
mov eax, 0x73c4c4
mov dword [ebp - 0x29], eax
mov dword [ebp - 0x25], 1
lea eax, [ebp - 0x41]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x73c47f
xor eax, eax
push ebp
push 0x73c478
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x73c461
cmp dword [ebp + 8], 0
jne 0x73c450
push 0xffffffffffffffff
mov eax, dword [ebp - 9]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x73c461
imul eax, dword [ebp + 8], 0x3e8
push eax
mov eax, dword [ebp - 9]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73c47f
mov eax, dword [ebp - 9]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73c4a4
lea eax, [ebp - 4]
call fcn.00409fc0
lea eax, [ebp + 0xc]
call fcn.00409fc0
ret

Function at 0x73eb68
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
mov eax, dword [0x90e594]
cmp dword [eax], 2
jne 0x73ebe0
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x73ebe0
lea eax, [ebp - 0x14]
push eax
push 0x73ebf4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
cmp eax, 1
sbb eax, eax
inc eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
mov edx, 0x10
xor ecx, ecx
mov dword [ebp - 8], ecx
test al, al
je 0x73ebe0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push edx
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7409f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x7409f9
mov eax, dword [ebp - 4]
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x740b06
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x740ae6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004269a4
lea eax, [ebp - 4]
mov ecx, 0x740b24
mov edx, esi
call fcn.0040b090
lea eax, [ebp - 0x2026]
xor ecx, ecx
mov edx, 0x2002
call fcn.00407a7c
lea esi, [ebp - 0x2026]
mov eax, dword [ebp - 4]
call fcn.0040ae24
mov edx, eax
mov eax, esi
call fcn.004273f8
lea eax, [ebp - 0x23]
xor ecx, ecx
mov edx, 0x1e
call fcn.00407a7c
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], 2
lea eax, [ebp - 0x2026]
mov dword [ebp - 0x1b], eax
mov eax, ebx
call fcn.0040ae24
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], 4
or word [ebp - 0x13], 0x10
or word [ebp - 0x13], 0x200
or word [ebp - 0x13], 0x400
lea eax, [ebp - 0x23]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
jne 0x740ad8
cmp dword [ebp - 0x11], 1
sbb eax, eax
inc eax
test al, al
je 0x740adc
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x740af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740b0d
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x740bac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
lea edi, [ebp - 9]
xor eax, eax
push ebp
push 0x740ccf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0042682c
test al, al
je 0x740cb9
xor edx, edx
push ebp
push 0x740caf
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00426434
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x740c9e
push dword fs:[edx]
mov dword fs:[edx], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00426790
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00426790
mov esi, eax
dec esi
test esi, esi
jbe 0x740c87
mov ebx, 1
mov eax, ebx
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042679c
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.004266c8
xor byte [edi], 0x32
mov eax, ebx
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042679c
mov edx, edi
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.004266f4
mov eax, dword [0x90de38]
mov eax, dword [eax]
call fcn.0061fccc
inc ebx
dec esi
jne 0x740c36
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740ca5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740cd6
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x740ce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x740e61
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.0062b7a8
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0062b7c8
mov ebx, eax
jmp 0x740e2d
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040aee0
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.004270c4
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.00424eb8
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.00424eb8
mov edx, dword [ebp - 0x240]
pop eax
call fcn.0040b1c8
je 0x740e04
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.0040aee0
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.00424eb8
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.00424eb8
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.0040b1c8
jne 0x740e1e
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.0062b7e8
mov ebx, eax
test ebx, ebx
jne 0x740d5f
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740e68
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.0040a020
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x740e74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x740f20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x740f3c
call fcn.0040a3a0
mov ebx, 0x400
xor eax, eax
push ebp
push 0x740eec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040afb8
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
push ebx
call sub.kernel32.dll_GetTempPathW
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x740f0a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x740f27
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x740f54
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x741010
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x74102c
call fcn.0040a3a0
mov dword [ebp - 0xc], 0x400
xor eax, eax
push ebp
push 0x740fdc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040afb8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x740fcd
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b200
jmp 0x740fd2
call fcn.0042ea9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x740ffa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x741017
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x741048
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x741103
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x741120
call fcn.0040a3a0
mov dword [ebp - 0xc], 0x400
xor eax, eax
push ebp
push 0x7410cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.0040afb8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x7410c0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b200
jmp 0x7410c5
call fcn.0042ea9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7410ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74110a
lea eax, [ebp - 4]
call fcn.00409fc0
ret

Function at 0x7426f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
mov eax, dword [ebp - 8]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x742788
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407a7c
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x742794
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040ae24
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040ae24
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74278f
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a020
ret
Function at 0x742ddc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov esi, ecx
push 0xf01ff
push edx
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
jne 0x742e09
mov eax, esi
mov edx, 0x742ed4
call fcn.0040a3a0
jmp 0x742eba
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x742e2a
mov eax, esi
mov edx, 0x742f08
call fcn.0040a3a0
jmp 0x742eba
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x41c
jg 0x742e49
je 0x742e84
sub eax, 5
je 0x742e68
dec eax
je 0x742e5a
sub eax, 0x415
je 0x742e76
jmp 0x742eba
sub eax, 0x41d
je 0x742eae
sub eax, 8
je 0x742e92
dec eax
je 0x742ea0
jmp 0x742eba
mov eax, esi
mov edx, 0x742f34
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x742f6c
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x742fa0
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x742ff0
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x743038
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x743088
call fcn.0040a3a0
jmp 0x742eba
mov eax, esi
mov edx, 0x7430c4
call fcn.0040a3a0
push ebx
call sub.advapi32.dll_CloseServiceHandle
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x743b9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x743c7f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x743c5f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x743c4e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040e1e0
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x743c2d
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, ebx
mov edx, 0x104
call fcn.0040afb8
mov eax, dword [ebx]
call fcn.0040ae24
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebx]
call fcn.0040ae24
push eax
call sub.kernel32.dll_lstrlenW_1
mov edx, eax
mov eax, ebx
call fcn.0040afb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x743c55
cmp dword [ebp - 8], 0
je 0x743c4d
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
Function at 0x743c90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x743ea4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x743e77
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x743ce1
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebx + 1]
call fcn.00427704
mov edx, dword [ebp - 4]
call fcn.004274bc
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x743d59
xor eax, eax
push ebp
push 0x743d4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call fcn.00406ef8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x743d59
mov eax, esi
call fcn.00409fc0
test bl, bl
je 0x743d7c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x743eb4
mov eax, dword [ebp - 0x24]
push eax
call sub.version.dll_VerQueryValueW
jmp 0x743d81
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x743db4
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
mov word [ebp - 0x26], ax
mov eax, edi
shr eax, 0x10
movzx eax, ax
movzx edx, word [ebp - 0x26]
shl edx, 0x10
or eax, edx
lea ecx, [ebp - 8]
mov edx, 8
call fcn.00425fd0
test bl, bl
je 0x743e0c
push 0x743ef4
push dword [ebp - 8]
push 0x743f24
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.0040b118
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x226]
call fcn.004274bc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x226]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x743e0c
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.004276d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x743e7e
xor eax, eax
push ebp
push 0x743e42
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x24], 0
je 0x743e38
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
call fcn.00406f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x743e4c
xor eax, eax
push ebp
push 0x743e6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.00427744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x743e76
ret