joyce8/EMBER2024-capa huggingface dataset:
Function at 0x545b3a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x390
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x38c], eax
push ebx
push esi
mov bl, dl
mov esi, ecx
call fcn.0050d35c
test al, al
je 0x545b7e
cmp dword [esi + 0x14], 8
jb 0x545b6b
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x545b7e
test bl, bl
jne 0x545b94
xor al, al
jmp 0x545b80
mov al, 1
mov ecx, dword [esp + 0x394]
pop esi
pop ebx
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret
push str.failed_to_delete_directory
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [esp + 0x14]
call fcn.0050c893
push 0x6bd4a4
lea eax, [esp + 0xc]
push eax
call fcn.00575c7a
int3

Function at 0x54649c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x390
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x38c], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
je 0x54654c
cmp dword [esi + 0x10], 0x3fff
jbe 0x5464ed
lea eax, [edi + 8]
push eax
push ecx
push ecx
lea ecx, [esp + 0x14]
call fcn.00546b30
push 0x6bd4a4
lea eax, [esp + 0xc]
jmp 0x546564
mov ecx, dword [edx]
mov edx, dword [edx + 4]
sub edx, ecx
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
jb 0x546504
mov eax, dword [esi]
jmp 0x546506
mov eax, esi
push edx
push ecx
push 3
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x546536
lea ecx, [edi + 8]
push ecx
push esi
push ecx
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00546bbd
push 0x6bd4a4
lea eax, [esp + 0xc]
jmp 0x546564
mov ecx, dword [esp + 0x394]
pop edi
pop esi
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 8
push str.ORegistryKey.SetValue_failure:_Registry_key_is_not_initialized
push ecx
lea ecx, [esp + 0x10]
call fcn.00546aba
push 0x6bd4a4
lea eax, [esp + 0xc]
push eax
call fcn.00575c7a
int3

Function at 0x5475e7
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x6c10c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x3c
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call fcn.00576720
add esp, 0xc
mov dword [ebp - 0x58], 0x3c
lea ecx, [ebp - 0x1c]
push esi
call fcn.00409657
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x58]
push ecx
push ebx
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x54764c
mov eax, dword [ebp - 0x4c]
push 3
pop esi
sub eax, esi
je 0x547670
sub eax, 1
je 0x54766b
sub eax, 1
je 0x54764e
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040968b
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00573599
mov esp, ebp
pop ebp
ret
push 2
pop esi
jmp 0x54764e
xor esi, esi
inc esi
jmp 0x54764e
Function at 0x5494ed
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3d4
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esp + 0xc], 1
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 4], 0xffffffff
je 0x54952c
push 0
call fcn.0054930a
test al, al
je 0x5495fb
lea eax, [esp + 0x10]
push eax
push edi
push ebx
call fcn.0054970d
push 0x3c
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00576720
and dword [esp + 0x28], 0
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x14], 0x3c
cmp byte [esp + 0x10], cl
mov eax, str.runas
cmove eax, ecx
cmp dword [ebx + 0x14], 8
mov dword [esp + 0x20], eax
jb 0x549572
mov eax, dword [ebx]
jmp 0x549574
mov eax, ebx
cmp dword [edi + 0x14], 8
mov dword [esp + 0x24], eax
jb 0x549582
mov eax, dword [edi]
jmp 0x549584
mov eax, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x34], 0x8000000
mov dword [esp + 0x1c], 0x340
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x5495d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
cmp eax, 0x4c7
jne 0x5495bb
xor al, al
jmp 0x5495e4
push edi
push ebx
push ecx
push eax
push ecx
lea ecx, [esp + 0x64]
call fcn.00549767
push 0x6bd4a4
lea eax, [esp + 0x54]
jmp 0x549614
mov ecx, dword [esp + 0x4c]
mov al, 1
mov dword [esi + 4], ecx
mov dword [esi + 8], 0x103
mov ecx, dword [esp + 0x3dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 0x14
push str.Attempting_to_start_a_new_process_when_the_process_has_already_been_started
push 0x43
lea ecx, [esp + 0x58]
call fcn.00512e06
push 0x6bd4a4
lea eax, [esp + 0x54]
push eax
call fcn.00575c7a
int3
Function at 0x54ac30
Capabilities:
Initialize winhttp library

Disassembly:
push 0x3b4
mov eax, 0x5d43b9
call fcn.00573e45
mov esi, ecx
mov dword [ebp - 0x3bc], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [esi], vtable.RefCounted.0
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b8], edi
mov dword [esi + 4], ebx
push ecx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc]
push ebx
mov dword [esi], 0x67b4a8
mov word [esi + 8], bx
call fcn.00519c18
push 7
pop edx
mov dword [esi + 0x38], ebx
lea eax, [esi + 0x3c]
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], ebx
cmp edx, 8
jb 0x54ac97
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea ebx, [esi + 0x54]
and dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], edx
cmp edx, 8
jb 0x54acae
mov eax, dword [ebx]
jmp 0x54acb0
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
push edi
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.00409657
lea edi, [esi + 0x84]
xor ecx, ecx
mov dword [edi + 0xc], ecx
xor eax, eax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov byte [edi + 0x18], cl
mov dword [edi + 0x1c], 0x5e
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x3b4]
mov byte [ebp - 4], 5
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb4], ecx
mov dword [esi + 0xb8], 0x57
mov dword [esi + 0xac], ecx
cmp dword [eax + 0x14], 8
jb 0x54ad1c
mov eax, dword [eax]
push ecx
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xa4], eax
test eax, eax
jne 0x54ad5b
push str.Failed_to_Open_Win_Http_session
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x79
lea ecx, [ebp - 0x3b0]
call fcn.0040d07c
push 0x6bd4a4
lea eax, [ebp - 0x3b0]
push eax
call fcn.00575c7a
push dword [ebp - 0x3b8]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0054aef6
push eax
mov ecx, ebx
call fcn.0040959d
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040968b
mov eax, esi
call fcn.00573def
ret 0x14
Function at 0x54b130
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x398
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x394], eax
mov eax, dword [ebp + 0xc]
mov edx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax + 0x10], edi
jne 0x54b15f
mov eax, edi
jmp 0x54b167
cmp dword [eax + 0x14], 8
jb 0x54b167
mov eax, dword [eax]
lea ecx, [edx + 0x54]
cmp dword [ecx + 0x14], 8
jb 0x54b172
mov ecx, dword [ecx]
push edi
push edi
push edi
push edi
push ecx
push eax
push dword [edx + 0xa8]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp dword [esi], edi
jne 0x54b219
mov ecx, esi
mov dword [esi], eax
call fcn.0054abb6
test eax, eax
jne 0x54b1bb
push str.Failed_to_open_get_request_for_given_file
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7c
lea ecx, [esp + 0x1c]
call fcn.0050bc8c
push 0x6bd4a4
lea eax, [esp + 0x14]
jmp 0x54b231
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x4d
mov ecx, esi
call fcn.0054abb6
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x54b203
push str.Failed_to_set_the_auto_logon_option
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8b
lea ecx, [esp + 0x1c]
call fcn.0050b51e
push 0x6bd4a4
lea eax, [esp + 0x14]
jmp 0x54b231
mov ecx, dword [esp + 0x39c]
pop edi
pop esi
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 8
push str.OHINTERNET_handle_already_set
push ecx
lea ecx, [esp + 0x18]
call fcn.0054c3fc
push 0x6bd4a4
lea eax, [esp + 0x14]
push eax
call fcn.00575c7a
int3
Function at 0x54c8f6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x390
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x38c], eax
push esi
push edi
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test edi, edi
je 0x54c97b
push 0
lea eax, [edi - 1]
mov ecx, esi
push eax
call fcn.0040d196
cmp dword [esi + 0x14], 8
jb 0x54c939
mov esi, dword [esi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x54c967
push 0x67b4b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [esp + 0x14]
call fcn.0040d07c
push 0x6bd4a4
lea eax, [esp + 0xc]
jmp 0x54c99b
mov ecx, dword [esp + 0x394]
pop edi
pop esi
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret
push 0x67b4b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [esp + 0x14]
call fcn.0040d07c
push 0x6bd4a4
lea eax, [esp + 0xc]
push eax
call fcn.00575c7a
int3
Function at 0x54da75
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x398
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x394], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 4]
and dword [esp + 4], 0
push edx
push 0x24
push eax
push 0
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x54dac2
mov ecx, dword [esp + 0x394]
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_query_service_Status
push 0x74
lea ecx, [esp + 0x10]
call fcn.004f086c
push 0x6bd4a4
lea eax, [esp + 0xc]
push eax
call fcn.00575c7a
int3

Function at 0x54dae2
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x54db1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 0x420
jne 0x54db26
call fcn.0054e263
cmp byte [edi + 0x14], 0
je 0x54db64
mov esi, dword [edi + 0xc]
jmp 0x54db43
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0054e2b4
xor al, al
jmp 0x54db66
add esi, 0xffffffe4
mov ecx, esi
call fcn.0054dae2
cmp esi, dword [edi + 8]
jne 0x54db39
mov ebx, dword [edi + 0xc]
mov esi, dword [edi + 8]
jmp 0x54db5a
mov ecx, esi
call fcn.0054d9f0
add esi, 0x1c
cmp esi, ebx
jne 0x54db50
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54db6d
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0xc]
push esi
push edi
push eax
mov esi, ecx
call fcn.0054da75
mov ecx, dword [esp + 0x18]
mov byte [ebx], 0
cmp ecx, 1
je 0x54dc63
cmp byte [esi + 0x14], 0
mov edi, dword [esp + 0x2c]
je 0x54dbbb
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0054dc7f
mov ecx, dword [esp + 0x18]
mov byte [ebx], 1
cmp ecx, 3
je 0x54dc02
lea eax, [esp + 0x38]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x54dbfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp eax, 0x426
je 0x54dbf6
lea eax, [esp + 0x10]
push eax
call fcn.0054e30a
xor al, al
jmp 0x54dc6b
mov al, 1
jmp 0x54dc6b
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x18]
cmp ecx, 1
je 0x54dc63
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x7fffffff
jb 0x54dc51
cmp edi, 0x2710
jbe 0x54dc2a
push 0xa
mov eax, edi
xor edx, edx
pop ecx
div ecx
jmp 0x54dc2f
mov eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0054da75
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
cmp ecx, 1
jne 0x54dc07
jmp 0x54dc55
mov ecx, dword [esp + 0x18]
cmp ecx, 1
je 0x54dc63
call fcn.0054e35c
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, 1
sete al
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 8
Function at 0x54dc7f
Capabilities:
Enumerate services

Disassembly:
push 0x68
mov eax, 0x5d491a
call fcn.00573eb3
mov esi, ecx
mov dword [ebp - 0x40], esi
xor ebx, ebx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
call fcn.0054e3ad
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x54dce0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x34], eax
cmp eax, 0xea
je 0x54dcf0
lea eax, [ebp - 0x34]
push eax
call fcn.0054e3fe
lea ecx, [ebp - 0x50]
call fcn.0041214f
call fcn.00573e00
ret 4
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.004120cd
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], eax
push ecx
push dword [ebp - 0x38]
push eax
push 1
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x54dd23
call edi
mov dword [ebp - 0x34], eax
jmp 0x54dcd7
mov edi, ebx
mov dword [ebp - 0x44], ebx
cmp edi, dword [ebp - 0x3c]
jae 0x54dce0
push ecx
push ecx
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x2d], bl
call fcn.0054d878
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, 0x7fffffff
jae 0x54dd64
lea eax, [ebp - 0x3c]
push eax
call fcn.0054e450
lea ecx, [ebp - 0x74]
call fcn.0054d9f0
jmp 0x54dce0
imul esi, edi, 0x24
mov byte [ebp - 4], 2
add esi, dword [ebp - 0x34]
push esi
call fcn.0054e4a2
push dword [esi]
lea ecx, [ebp - 0x2c]
call fcn.00409613
push 0x3c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x74]
call fcn.0054da18
mov bl, al
lea ecx, [ebp - 0x2c]
push 0
neg bl
push 1
sbb bl, bl
call fcn.0040968b
lea ecx, [ebp - 0x74]
add bl, 1
je 0x54ddb2
call fcn.0054d9f0
xor ebx, ebx
mov byte [ebp - 4], bl
jmp 0x54de18
push dword [ebp + 8]
lea eax, [ebp - 0x2d]
push eax
call fcn.0054db6d
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x40]
jmp 0x54ddfa
xor ebx, ebx
cmp byte [ebp - 0x2d], bl
je 0x54de0d
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [eax + 8]
call fcn.0054e09b
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.0054d9f0
inc edi
mov dword [ebp - 0x44], edi
jmp 0x54dd28

Function at 0x54de21
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x390
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x38c], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x10000
push edi
call fcn.0054da18
test al, al
je 0x54de5e
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x54de6d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x430
jne 0x54de83
mov ecx, dword [esp + 0x394]
pop edi
pop esi
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 4
push edi
push str.failed_to_delete_service__s
call esi
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0054e54a
push 0x6bd4a4
lea eax, [esp + 0xc]
push eax
call fcn.00575c7a
int3
Function at 0x54dea6
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x394
mov eax, dword [0x6c10c8]
xor eax, esp
mov dword [esp + 0x390], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0xc]
push ebx
push esi
cmp dword [eax + 0x10], 0
mov ebx, ecx
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 8
pop ecx
jne 0x54dede
xor eax, eax
jmp 0x54dee5
cmp dword [eax + 0x14], ecx
jb 0x54dee5
mov eax, dword [eax]
cmp dword [esi + 0x14], ecx
jb 0x54deec
mov esi, dword [esi]
cmp dword [edx + 0x14], ecx
jb 0x54def3
mov edx, dword [edx]
cmp dword [edi + 0x14], ecx
jb 0x54defc
mov ecx, dword [edi]
jmp 0x54defe
mov ecx, edi
push 0
push 0
push 0
push 0
push eax
push esi
push 1
push 2
push 0x10
push 0x20000000
push edx
push ecx
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebx + 4], eax
test eax, eax
je 0x54df3b
mov ecx, dword [esp + 0x39c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00573599
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
call fcn.0054e5dc
push edi
push str.failed_to_create_service__s
call esi
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.0054e54a
push 0x6bd4a4
lea eax, [esp + 0x14]
push eax
call fcn.00575c7a
int3

Function at 0x54df74
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6c10c8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x30], 0x15180
inc eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
push 2
push dword [ecx + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00573599
mov esp, ebp
pop ebp
ret 0x10
Function at 0x557bc8
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x5d5e79
call fcn.00573e45
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x557cc8
cmp byte [ebx + 0x3d], 0
je 0x557cc8
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x557c02
xor al, al
jmp 0x557cca
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0048ed36
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x557c60
sub eax, 1
je 0x557c64
dec eax
sub eax, 1
je 0x557cb6
xor bl, bl
jmp 0x557cb8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x557c9c
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005ac0d4
add esp, 0x10
cmp esi, eax
jne 0x557c5c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x557cb6
test esi, esi
jne 0x557c26
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040db74
jmp 0x557c20
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040c666
mov al, bl
jmp 0x557cca
mov al, 1
call fcn.00573def
ret
Function at 0x568307
Capabilities:
Get geographical location

Disassembly:
push 0x60
mov eax, 0x5d8c57
call fcn.00573e45
mov esi, ecx
push 1
push 0x3e8
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
mov dword [ebp - 0x68], ebx
call fcn.005681a2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
sete al
test al, al
je 0x568433
push 1
push 0xbb9
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
call fcn.005681a2
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
push 0x655240
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00409613
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x58]
call fcn.0040dc28
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040968b
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
sub eax, ecx
push 0x18
pop edi
cdq
idiv edi
mov dword [ebp - 0x6c], edi
cmp eax, 3
jb 0x56841d
xor esi, esi
inc esi
dec eax
cmp eax, esi
jbe 0x56841d
lea eax, [edi + ecx]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409657
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.0048f5b0
push 0x6e85b8
lea ecx, [ebp - 0x40]
call fcn.0040a36a
test eax, eax
je 0x5683f9
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0040968b
mov eax, dword [ebp - 0x60]
add esi, 2
mov ecx, dword [ebp - 0x64]
add edi, 0x30
sub eax, ecx
cdq
idiv dword [ebp - 0x6c]
dec eax
cmp esi, eax
jb 0x5683a7
jmp 0x56841d
lea eax, [esi + 1]
imul eax, eax, 0x18
lea ecx, [ebp - 0x28]
add eax, dword [ebp - 0x64]
cmp ecx, eax
je 0x568412
push 0xffffffffffffffff
push ebx
push eax
call fcn.00409884
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0040968b
lea ecx, [ebp - 0x64]
call fcn.0040da5d
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.0040968b
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x68]
push 2
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x20000070
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, dword [ebp - 0x68]
sub eax, ebx
je 0x56847c
sub eax, 1
je 0x56847a
sub eax, 1
je 0x56847c
sub eax, 1
je 0x56847a
mov eax, dword [0x6c8680]
mov ecx, 0x6c8680
push 0x10493c5
call dword [eax + 4]
jmp 0x56847c
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040968b
mov al, bl
call fcn.00573def
ret