joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64a448
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, edx
mov dword [esp], eax
xor esi, esi
mov eax, dword [esp]
test eax, eax
je 0x64a45f
mov eax, dword [eax - 4]
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
jmp 0x64a46a
inc ebx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [edx + edx*2]
mov eax, ebx
sub eax, edx
test eax, eax
jg 0x64a469
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, ebx
call fcn.0040c438
xor ebx, ebx
cmp esi, dword [esp + 4]
jge 0x64a5f3
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi]
and dl, 0xfc
movzx edx, dl
shr edx, 2
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp + 4]
jge 0x64a5a9
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi]
and dl, 3
movzx edx, dl
shl edx, 4
mov ecx, dword [esp]
movzx ecx, byte [ecx + esi + 1]
and cl, 0xf0
movzx ecx, cl
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp + 4]
jge 0x64a576
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi + 1]
and dl, 0xf
movzx edx, dl
shl edx, 2
mov ecx, dword [esp]
movzx ecx, byte [ecx + esi + 2]
and cl, 0xc0
movzx ecx, cl
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
jmp 0x64a5e6
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi + 1]
and dl, 0xf
movzx edx, dl
shl edx, 2
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040be88
mov byte [eax + ebx - 1], 0x3d
jmp 0x64a5e6
inc ebx
mov eax, edi
call fcn.0040be88
mov edx, dword [esp]
movzx edx, byte [edx + esi]
and dl, 3
movzx edx, dl
shl edx, 4
movzx edx, byte [edx + 0x8c6a60]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.0040be88
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.0040be88
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp + 4]
jl 0x64a4ad
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x64f77c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov byte [0x8eb7f0], 3
cmp bl, 3
je 0x64f871
sub bl, 2
jae 0x64f7bb
call fcn.00439674
cmp eax, 6
jl 0x64f7bb
call fcn.0064f6e8
cmp dword [0x8eb7f4], 0
je 0x64f7bb
mov byte [0x8eb7f0], 1
jmp 0x64f871
call fcn.0064f740
cmp edx, 0
jne 0x64f7c8
cmp eax, 0
je 0x64f871
push esp
call sub.kernel32.dll_QueryPerformanceCounter
cmp dword [esp + 4], 0
jne 0x64f7df
cmp dword [esp], 0
je 0x64f871
mov byte [0x8eb7f0], 2
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push 0
push 0x3e8
call fcn.0064f740
call fcn.0040e75c
push edx
push eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
call fcn.0040e75c
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
call sub.kernel32.dll_GetTickCount
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [0x8eb800], eax
mov dword [0x8eb804], edx
cmp dword [0x8eb804], 0
jne 0x64f85b
cmp dword [0x8eb800], 0xdbba0
jbe 0x64f871
jmp 0x64f85d
jle 0x64f871
mov dword [0x8eb800], 0
mov dword [0x8eb804], 0
add esp, 0x10
pop ebx
ret
Function at 0x65155c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x8c6bf4
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x65157b
mov esi, 1
mov edx, 0x8c6cfc
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x6515ef
dec ebx
je 0x651611
dec ebx
je 0x651633
dec ebx
je 0x651654
jmp 0x65166e
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x65166e
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x65166e
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x65166e
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x6515df
inc esi
add edx, 0x40
cmp esi, 9
jne 0x651597
mov esi, 0x20
mov eax, 0x8c6c24
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x651693
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6516d0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x8c6cab]
test bl, bl
jbe 0x651701
lea eax, [esi + 0x3e0]
call fcn.006516ac
lea eax, [esi + 0x3fc]
call fcn.006516ac
dec bl
jne 0x6516e7
mov cl, 0x30
mov edi, 0x8c6c7c
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x651722
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x65172f
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x65170b
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x65173c
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov bl, 1
lea esi, [ebp - 0x425]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.006514f4
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x651759
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x45]
movzx edx, byte [esi]
mov eax, dword [ebp - 0xc]
call fcn.006514f4
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.006514f4
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x651776
mov bl, 1
lea esi, [ebp - 0x3a5]
mov ecx, esi
lea eax, [ebp - 0x425]
mov edx, ebx
call fcn.006516d0
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x6517a0
mov bl, 1
mov eax, 0x8c6b74
lea edx, [ebp - 0xa5]
cmp bl, 0x20
ja 0x6517d9
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x426]
mov byte [edx], cl
jmp 0x6517e6
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x426]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x6517c5
mov byte [ebp - 0xd], 1
lea esi, [ebp - 0x3a5]
cmp byte [ebp + 8], 0
je 0x651810
lea ecx, [ebp - 0x65]
mov edx, esi
lea eax, [ebp - 0x85]
call fcn.0065155c
jmp 0x651837
movzx eax, byte [ebp - 0xd]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d5]
lea ecx, [ebp - 0x65]
lea eax, [ebp - 0x85]
call fcn.0065155c
mov bl, 0x20
lea eax, [ebp - 0xa5]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x65183f
push esi
lea esi, [ebp - 0x85]
lea edi, [ebp - 0xa5]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x65]
lea edi, [ebp - 0x85]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 0xd]
add esi, 0x30
cmp byte [ebp - 0xd], 0x11
jne 0x6517f8
mov bl, 0x40
mov esi, 0x8c6bb4
lea eax, [ebp - 0x3e5]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x6518a5
movzx edx, dl
movzx edx, byte [ebp + edx - 0x86]
mov byte [eax], dl
jmp 0x6518b2
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc6]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x65188e
mov bl, 1
lea esi, [ebp - 0x3e5]
movzx ecx, byte [esi]
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0065151c
inc ebx
inc esi
cmp bl, 0x41
jne 0x6518c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x655a90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov edi, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [esp + 8], al
shl edx, 3
and dl, 0xff
movzx eax, byte [esi + 5]
shr eax, 5
or dl, al
mov byte [esp + 9], dl
movzx eax, byte [esi + 5]
shl eax, 2
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov ebp, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor esi, ecx
and esi, 1
inc edx
cmp edx, 8
jne 0x655b3d
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec ebp
jne 0x655b38
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.0040c438
push 1
mov eax, edi
call fcn.0040be88
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.0065173c
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x66cff4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004b998c
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
call fcn.0040712c
mov dword [ebp - 0x10], eax
xor ebx, ebx
push ebp
push 0x66d093
push dword fs:[ebx]
mov dword fs:[ebx], esp
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x18]
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ecx
test eax, eax
jbe 0x66d06b
movzx ebx, byte [edx]
mov esi, dword [ebp - 0xc]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x8c6f50]
mov esi, dword [ebp - 0xc]
shr esi, 8
xor ebx, esi
mov dword [ebp - 0xc], ebx
inc edx
dec eax
jne 0x66d047
test ecx, ecx
jne 0x66d02e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66d09a
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004b998c
mov eax, dword [ebp - 0x10]
call fcn.0040717c
pop eax
jmp eax

Function at 0x6b0ce0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040b8b4
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x6b0d11
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040ba4c
add esp, 0x24
pop ebx
ret
Function at 0x6d75a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6d75a8
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6d7757
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6d7770
call fcn.0040ca8c
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.006d57b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6d7784
call fcn.0068336c
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6d7621
mov eax, dword [eax - 4]
test eax, eax
jle 0x6d7662
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.006d57b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d77ec
call fcn.0068336c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040ca34
mov eax, esi
mov edx, 0x6d7818
call fcn.0040ca34
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6d7678
mov eax, dword [eax - 4]
test eax, eax
jle 0x6d76e4
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d782c
call fcn.0068336c
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040ca34
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6d76ad
mov eax, dword [eax - 4]
test eax, eax
jle 0x6d76d8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d785c
call fcn.0068336c
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040ca34
mov eax, esi
mov edx, 0x6d7818
call fcn.0040ca34
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6d76ee
mov eax, dword [eax - 4]
test eax, eax
jle 0x6d7719
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6d7888
call fcn.0068336c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040ca34
mov eax, esi
mov edx, 0x6d7818
call fcn.0040ca34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d775e
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040b914
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7041c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x704224
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
call sub.kernel32.dll_GetACP
push eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040c8d8
mov eax, dword [ebp - 0x14]
pop edx
call fcn.0042fff0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70422b
lea eax, [ebp - 0x14]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x704fbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x705054
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00439660
cmp eax, 2
jne 0x704ffc
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x705034
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040c534
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040c0ac
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.0040c30c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70505b
lea eax, [ebp - 8]
call fcn.0040b8fc
lea eax, [ebp - 4]
call fcn.0040b8d8
pop eax
jmp eax

Function at 0x7053fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.0040c824
mov edx, eax
mov eax, ebx
call fcn.00704e24
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00704f00
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x70546e
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x70599c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x705a50
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x705a38
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040c9b0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.0040c824
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x705a38
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x705a60
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x705a38
cmp dword [ebp - 0xc], 0x34
jne 0x705a38
mov bl, 1
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x705a57
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x707528
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7077c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.00705a64
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x8cb37c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x8cb380], eax
mov eax, dword [ebp - 0x24]
mov dword [0x8cb384], eax
call fcn.00439660
cmp eax, 2
sete byte [0x8cab55]
push 0x7077d0
call sub.kernel32.dll_GetModuleHandleW
lea edx, [ebp - 4]
call fcn.0070596c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x8cab55], 0
jne 0x7075b7
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0070599c
test al, al
je 0x7075b7
mov eax, dword [ebp - 0x4c]
mov dword [0x96d0ec], eax
jmp 0x7075be
xor eax, eax
mov dword [0x96d0ec], eax
call fcn.00705c20
and eax, 0x7f
cmp eax, 0x1e
ja case.0x7075cf.0
jmp dword [eax*4 + 0x7075d6]
mov byte [0x8cab50], 1
jmp case.0x7075cf.0
mov byte [0x8cab51], 1
jmp case.0x7075cf.0
mov byte [0x8cab52], 1
jmp case.0x7075cf.0
mov byte [0x8cab53], 1
jmp case.0x7075cf.0
mov byte [0x8cab54], 1
jmp case.0x7075cf.0
mov byte [0x8cab56], 1
mov byte [0x8cab57], 1
jmp case.0x7075cf.0
mov byte [0x8cab56], 1
mov byte [0x8cab58], 1
jmp case.0x7075cf.0
mov byte [0x8cab56], 1
mov byte [0x8cab58], 1
mov byte [0x8cab59], 1
jmp case.0x7075cf.0
mov byte [0x8cab5a], 1
jmp case.0x7075cf.0
mov byte [0x8cab5b], 1
jmp case.0x7075cf.0
mov byte [0x8cab5c], 1
jmp case.0x7075cf.0
mov byte [0x8cab5d], 1
jmp case.0x7075cf.0
mov byte [0x8cab5e], 1
jmp case.0x7075cf.0
mov byte [0x8cab5f], 1
jmp case.0x7075cf.0
mov byte [0x8cab60], 1
jmp case.0x7075cf.0
mov byte [0x8cab61], 1
jmp case.0x7075cf.0
mov byte [0x8cab62], 1
jmp case.0x7075cf.0
mov byte [0x8cab63], 1
jmp case.0x7075cf.0
mov byte [0x8cab64], 1
jmp case.0x7075cf.0
mov byte [0x8cab65], 1
jmp case.0x7075cf.0
mov byte [0x8cab66], 1
jmp case.0x7075cf.0
mov byte [0x8cab67], 1
jmp case.0x7075cf.0
mov byte [0x8cab68], 1
jmp case.0x7075cf.0
mov byte [0x8cab69], 1
jmp case.0x7075cf.0
mov byte [0x8cab6a], 1
jmp case.0x7075cf.0
mov byte [0x8cab6b], 1
jmp case.0x7075cf.0
mov byte [0x8cab6c], 1
jmp case.0x7075cf.0
mov byte [0x8cab6d], 1
jmp case.0x7075cf.0
mov byte [0x8cab6e], 1
jmp case.0x7075cf.0
mov byte [0x8cab6f], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7077cb
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x70e3b8
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov ebx, edx
lea esi, [ebp - 0x2c]
xor edx, edx
push ebp
push 0x70e5c2
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x70e3ed
call fcn.0043ab30
xor edx, edx
push ebp
push 0x70e5b1
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x14
mov eax, ebx
call fcn.0040c824
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x70e41c
call fcn.0043ab30
xor edx, edx
push ebp
push 0x70e591
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e450
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e449
call fcn.0043ab30
mov dword [esi + 4], 1
mov eax, dword [esi + 4]
cmp eax, 1
je 0x70e4c8
cmp eax, 3
je 0x70e4c8
mov byte [ebp - 1], 1
call fcn.0040b014
call fcn.0040b014
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x70e5cc
mov eax, 0xcccccccd
mul dword [esi + 0x18]
shr edx, 3
mov ebx, edx
cmp ebx, 0x3e8
jge 0x70e494
mov ebx, 0x3e8
jmp 0x70e4a1
cmp ebx, 0x2710
jle 0x70e4a1
mov ebx, 0x2710
push ebx
call sub.kernel32.dll_Sleep
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e4c8
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e4ce
call fcn.0043ab30
jmp 0x70e4ce
cmp dword [esi + 4], 3
je 0x70e478
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x70e4eb
call fcn.0043ab30
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e56a
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e50a
call fcn.0043ab30
mov dword [esi + 4], 1
jmp 0x70e56a
mov eax, 0xcccccccd
mul dword [esi + 0x18]
shr edx, 3
mov ebx, edx
cmp ebx, 0x3e8
jge 0x70e52f
mov ebx, 0x3e8
jmp 0x70e53c
cmp ebx, 0x2710
jle 0x70e53c
mov ebx, 0x2710
push ebx
call sub.kernel32.dll_Sleep
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x70e56a
call sub.kernel32.dll_GetLastError
cmp eax, 0x426
je 0x70e561
call fcn.0043ab30
mov dword [esi + 4], 1
jmp 0x70e570
cmp dword [esi + 4], 2
je 0x70e513
cmp dword [esi + 4], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70e598
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
pop eax
jmp eax
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret