joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f68d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.005caa70
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004d1230
mov ebx, eax
push ebx
push esi
call fcn.004d1110
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4f6959
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f6933
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004d1180
push esi
call fcn.004d12d0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4f6959
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004d1230
mov ebx, eax
push ebx
push esi
call fcn.004d1110
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4f69c8
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f69ae
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004d1180
push esi
call fcn.004d12d0
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x4f6951
push esi
call fcn.004d12d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x51d0a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x51d0c7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x51d0b6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x5c1030
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606ab3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x69def4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x6a46bc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x6a46bc
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x6099b4
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.005c4c30
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5c7880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x6a61a0], ecx
inc eax
cmp eax, 0x100
jb 0x5c7882
cmp eax, 0x800
jae 0x5c7953
nop
mov edx, dword [eax*4 + 0x6a5da0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x6a61a0]
mov dword [eax*4 + 0x6a61a0], edx
inc eax
cmp eax, 0x800
jb 0x5c7930
mov dword [0x6a46c8], 0x5c86f0
call fcn.005c8520
mov ecx, dword [0x6a46c8]
test eax, eax
mov edx, 0x5c8790
cmove ecx, edx
mov dword [0x6a46c8], ecx
ret
Function at 0x5c8a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x5c8a90
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x5c8ac2
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x5c8abf
inc esi
cmp esi, edx
jb 0x5c8ab0
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x5c8bec
cmp ecx, 3
jbe 0x5c8b02
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x5c8b40
cmp cl, 0xff
je 0x5c8b40
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x5c8aa4
dec ecx
shl eax, cl
and eax, 7
je 0x5c8ada
movzx ecx, byte [eax + 0x67dee0]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x67ded8], 0
mov cl, byte [edx + 4]
je 0x5c8b2a
test cl, cl
je 0x5c8b2a
cmp cl, 0xff
jne 0x5c8ada
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x5c8aa4
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x5c8b6e
lea edx, [edi + ebx]
add edx, esi
jmp 0x5c8b74
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x5c8bb2
movzx edi, byte [eax + 0x67dee0]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x5c8b9e
cmp cl, 0xff
jne 0x5c8bb2
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x5c8b61
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x5c8aa4
pop edi
pop esi
cmp ecx, 3
jbe 0x5c8c01
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5cc362
Capabilities:
Set registry value

Disassembly:
push 0x238
mov eax, 0x606e9e
call fcn.005cba3f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.005d4960
push str.GoodZipService
lea eax, [ebp - 0x218]
push 0x609c18
push eax
call fcn.0040f920
add esp, 0x18
lea ecx, [ebp - 0x244]
call fcn.00407550
and dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.004075c0
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x5cc3f8
push 0xf013f
push 0
push str.SoftWare
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5cc47d
xor edi, edi
lea eax, [ebp - 0x220]
push edi
push eax
push edi
push 0xf013f
jmp 0x5cc41f
push 0xf003f
push 0
push str.SoftWare
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5cc47d
xor edi, edi
lea eax, [ebp - 0x220]
push edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x5cc447
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5cc47d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push edi
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x244]
call fcn.004075a0
call fcn.005cb9fa
ret 0xc

Function at 0x5cc490
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x606ece
call fcn.005cba0b
lea ecx, [ebp - 0x38]
call fcn.00407550
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.004075c0
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x5cc4c3
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5cc533
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x609b1c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x5cc500
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5cc533
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.004075a0
call fcn.005cb9e5
ret 8
Function at 0x5cc543
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x606ef4
call fcn.005cba3f
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.005d4960
push str.GoodZipService
lea eax, [ebp - 0x218]
push 0x609c18
push eax
call fcn.0040f920
add esp, 0x18
lea ecx, [ebp - 0x248]
call fcn.00407550
and dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004075c0
test eax, eax
lea eax, [ebp - 0x21c]
push eax
je 0x5cc5d7
push 0x20119
push 0
push str.SoftWare
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
test eax, eax
jne 0x5cc658
lea eax, [ebp - 0x220]
push eax
push 0x20119
jmp 0x5cc5fc
push 0x20019
push 0
push str.SoftWare
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
test eax, eax
jne 0x5cc658
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call ebx
test eax, eax
je 0x5cc61f
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5cc658
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x248]
call fcn.004075a0
call fcn.005cb9fa
ret 0xc

Function at 0x5cc66b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
xor esi, esi
push eax
mov edi, 0xf003f
mov dword [ebp - 8], esi
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5cc6ed
push esi
lea eax, [ebp - 4]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x609b1c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x5cc6ed
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x5cc6e2
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], 0
je 0x5cc6ed
push dword [ebp - 8]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x5cc9c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov ebx, ecx
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp + 0x18]
push 0x200
mov dword [ebp - 0xc34], eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.005d4960
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.005d4960
push 0x208
lea eax, [ebp - 0x60c]
push 0
push eax
call fcn.005d4960
push 0x208
lea eax, [ebp - 0xa1c]
push 0
push eax
call fcn.005d4960
push 0x208
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.005d4960
push 0x208
lea eax, [ebp - 0xc24]
push 0
push eax
call fcn.005d4960
add esp, 0x48
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5cca82
cmp byte [ebp + 0x1c], al
jne 0x5ccb46
lea eax, [ebp - 0x60c]
push edi
push eax
call fcn.005edfa4
push dword [ebp - 0xc2c]
lea eax, [ebp - 0x204]
push eax
call fcn.005edfa4
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.005edfa4
push dword [ebp - 0xc30]
lea eax, [ebp - 0x404]
push eax
call fcn.005edfa4
push dword [ebp - 0xc34]
lea eax, [ebp - 0xc24]
push eax
call fcn.005edfa4
push 0
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0xa1c]
push str.__s___d
push eax
call fcn.0040f920
add esp, 0x38
mov byte [ebp - 0xc25], 0
lea eax, [ebp - 0xc25]
mov ecx, ebx
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x814]
push str.99DBFBB4_9D93_4F50_94F7_74A39CBBEE52
push 0x6097e8
push eax
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.005d16bd
cmp byte [ebp - 0xc25], 0
je 0x5ccb46
mov byte [esi], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005caa5c
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x5cd7a2
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
call fcn.005ce0ef
test eax, eax
jne 0x5cd7bb
push 3
pop eax
jmp 0x5cd876
mov ecx, esi
call fcn.005ce0f3
test eax, eax
je 0x5cd7cd
xor eax, eax
jmp 0x5cd876
push edi
push 2
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x5cd7eb
push 4
pop eax
jmp 0x5cd875
cmp dword [esi + 0x14], 8
jb 0x5cd7f5
mov edx, dword [esi]
jmp 0x5cd7f7
mov edx, esi
lea eax, [esi + 0x30]
cmp dword [eax + 0x14], 8
jb 0x5cd802
mov eax, dword [eax]
push ebx
lea ebx, [esi + 0x18]
cmp dword [ebx + 0x14], 8
jb 0x5cd816
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
jmp 0x5cd819
mov dword [ebp - 8], ebx
push edi
push edi
push edi
push edi
push edi
push edx
push 1
push dword [esi + 0x48]
push 1
push 0xf01ff
push eax
push dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x5cd861
cmp dword [ebx + 0x14], 8
jb 0x5cd845
mov ebx, dword [ebx]
push 0xf01ff
push ebx
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x5cd864
push 5
pop edi
jmp 0x5cd86b
mov ebx, dword [ebp - 4]
mov dword [esi + 0x54], 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5cd98e
Capabilities:
Check if file exists

Disassembly:
push 0x4a0
mov eax, 0x60771f
call fcn.005cba3f
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x5cdb09
lea ecx, [ebp - 0x47c]
call fcn.005cd6b5
lea ecx, [ebp - 0x47d]
mov dword [ebp - 4], ebx
call fcn.00454950
cmp dword [esi + 0x14], 8
mov byte [ebp - 4], 1
jb 0x5cd9d4
mov eax, dword [esi]
jmp 0x5cd9d6
mov eax, esi
push eax
lea ecx, [ebp - 0x47d]
call fcn.005cc6f5
test al, al
je 0x5cdaf3
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.005d4960
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x5cda09
mov eax, dword [esi]
jmp 0x5cda0b
mov eax, esi
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push eax
mov ecx, edi
call fcn.005ce01c
cmp dword [esi + 0x14], 8
jb 0x5cda27
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x47c]
call fcn.005ce285
test eax, eax
jne 0x5cdaf3
push str.system32
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, eax
test esi, esi
je 0x5cdaf3
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005d4960
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x4ac]
call fcn.00407550
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4ac]
call fcn.004077f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5cdad7
sub esp, 0x18
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.00405c70
call fcn.00426e80
add esp, 0x18
push dword [ebp - 0x484]
lea ecx, [ebp - 0x4ac]
call fcn.00407820
lea ecx, [ebp - 0x4ac]
call fcn.004075a0
lea ecx, [ebp - 0x47d]
call fcn.004a1050
lea ecx, [ebp - 0x47c]
call fcn.005cd713
call fcn.005cb9fa
ret 4
Function at 0x5ce01c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push esi
mov esi, dword [ebp + 8]
push edi
push str.SYSTEMCurrentControlSetServices_
push eax
xor edi, edi
call fcn.005edfa4
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.005edf33
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x204]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5ce0da
lea eax, [ebp + 0x10]
push eax
push ebx
push edi
push edi
push str.ImagePath
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5ce0ce
push 4
push 0x67e72c
push ebx
call fcn.005ee07b
add esp, 0xc
test eax, eax
jne 0x5ce0cb
lea ecx, [ebx + 8]
movzx eax, word [ecx]
mov word [ebx], ax
test ax, ax
je 0x5ce0cb
lea ecx, [ecx + 2]
mov ax, word [ecx]
mov word [ecx - 8], ax
cmp word [ecx], di
jne 0x5ce0bc
xor edi, edi
inc edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005caa5c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5ce0fb
Capabilities:
Start service

Disassembly:
push edi
mov edi, ecx
call fcn.005ce0f3
test eax, eax
jne 0x5ce10a
inc eax
pop edi
ret
mov ecx, edi
call fcn.005ce0f7
test eax, eax
je 0x5ce119
xor eax, eax
pop edi
ret
push ebx
push esi
push 2
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x5ce131
push 4
jmp 0x5ce178
lea eax, [edi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x5ce13c
mov eax, dword [eax]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x5ce15b
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 7
jmp 0x5ce178
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
test eax, eax
jne 0x5ce17b
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [edi + 0x4c]
call esi
push 6
pop eax
jmp 0x5ce18a
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 0x58], 1
xor eax, eax
pop esi
pop ebx
pop edi
ret
Function at 0x5ce285
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x5ce2b2
push 4
pop eax
jmp 0x5ce2f9
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x5ce2ca
push 7
pop esi
jmp 0x5ce2f0
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005caa5c
mov esp, ebp
pop ebp
ret 4
Function at 0x5ce4c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x3c
mov eax, 0x6077ce
call fcn.005cba3f
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push 0
push eax
mov dword [ebp - 0x44], ebx
call fcn.00424730
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push str.LangLang.xml
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041e1d0
push ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esp
push eax
call fcn.00413500
call fcn.0041f360
add esp, 0x18
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x5ce594
push 0x67e7c0
push str.Language_xml
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x5ce627
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp - 0x44]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x5ce627
test ebx, ebx
je 0x5ce627
cmp edi, 0x100000
ja 0x5ce627
push edi
call fcn.005caf77
mov dword [esi + 0x1c], eax
pop ecx
test eax, eax
je 0x5ce627
push edi
push 0
push eax
call fcn.005d4960
push edi
push ebx
push dword [esi + 0x1c]
call fcn.005d5db0
add esp, 0x18
push 0x48
call fcn.005caa24
pop ecx
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x5ce5b2
mov ecx, eax
call fcn.005c1030
mov ecx, eax
jmp 0x5ce5b4
xor ecx, ecx
mov byte [ebp - 4], 1
mov dword [esi + 0x24], ecx
test ecx, ecx
jne 0x5ce5d3
cmp dword [esi + 0x1c], ecx
je 0x5ce627
push dword [esi + 0x1c]
call fcn.005caaab
and dword [esi + 0x1c], 0
pop ecx
jmp 0x5ce627
mov eax, dword [ecx]
push 1
push 0
push dword [esi + 0x1c]
call dword [eax + 8]
mov ecx, dword [esi + 0x24]
push str.TheConfigure
call fcn.005c1da0
mov dword [esi + 0x20], eax
test eax, eax
jne 0x5ce62b
cmp dword [esi + 0x1c], eax
je 0x5ce605
push dword [esi + 0x1c]
call fcn.005caaab
and dword [esi + 0x1c], 0
pop ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x5ce627
lea eax, [ecx - 4]
cmp dword [eax], 0
je 0x5ce61c
mov eax, dword [ecx]
push 3
call dword [eax]
jmp 0x5ce623
push eax
call fcn.005caaab
pop ecx
and dword [esi + 0x24], 0
xor esi, esi
jmp 0x5ce62e
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00420750
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00420750
mov eax, esi
call fcn.005cb9fa
ret 4