joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a81f
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x741954
mov dword [ebp - 0x440], eax
call fcn.00402590
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00530310
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x50a8c3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x50a8c3
xor ecx, ecx
lea esi, [edi + 1]
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00468fb0
mov ebx, eax
xor eax, eax
push esi
push eax
push ebx
call fcn.00530310
add esp, 0x10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x50a8d4
push ebx
call fcn.00468fb9
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468d3e
leave
ret
mov eax, dword [0x747094]
mov dword [ebp - 0xc], eax
mov ax, word [0x747098]
push 0x208
mov word [ebp - 8], ax
call fcn.00468fb0
mov edi, eax
mov dword [ebp - 0x43c], ebx
movzx eax, word [ebx]
pop ecx
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x50a949
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x50a9e8
push edi
call fcn.00468fb9
push 2
call fcn.00468fb0
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0xc]
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x50a9e8
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x50a950
sub esi, ecx
lea eax, [ebp - 0x218]
sar esi, 1
push esi
push edi
push eax
call fcn.00534019
add esp, 0xc
test eax, eax
je 0x50a998
mov esi, dword [ebp - 0x43c]
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x50a97a
movzx eax, word [esi]
mov dword [ebp - 0x43c], esi
test ax, ax
je 0x50a9e8
jmp 0x50a8fc
lea eax, [ebp - 0x218]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s_s
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00428940
add esp, 0x14
lea eax, [ebp - 0x420]
lea ecx, [ebp - 0x438]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x440]
push eax
call fcn.00403100
lea ecx, [ebp - 0x438]
call fcn.00402630
push ebx
call fcn.00468fb9
push edi
call fcn.00468fb9
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x50a8c5
Function at 0x50a9fe
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x50aa84
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00530310
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x50aa84
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x50aa79
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00533ea4
pop ecx
pop ecx
test eax, eax
je 0x50aa94
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x50aa59
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00468d3e
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x50aa86

Function at 0x50ae2d
Capabilities:
Terminate process

Disassembly:
push 0x20
mov eax, 0x6becb5
call fcn.0057109f
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push eax
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x50aeb8
cmp esi, 0xffffffff
je 0x50aeb8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.0050a81f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0050ad09
add esp, 0x10
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.00402630
test bl, bl
je 0x50aeb8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x50aeb8
cmp byte [ebp + 0x14], 0
je 0x50aeb8
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp - 0x2c], 0
test esi, esi
je 0x50aed6
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x50aed6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
call fcn.00571049
ret
Function at 0x50aede
Capabilities:
Enumerate processes
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x50af7a
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x50af7a
push edi
xor edi, edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push ebx
push eax
push dword [ebp - 0x228]
call fcn.0050ae2d
add esp, 0x10
test al, al
je 0x50af42
inc edi
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x50af24
test edi, edi
jle 0x50af75
push 0x74895c
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, edi
pop edi
jmp 0x50af7d
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00468d3e
leave
ret

Function at 0x50afd6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.00530310
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0050af8b
mov eax, dword [ebp - 0x11c]
add esp, 0xc
cmp eax, 5
jne 0x50b055
cmp dword [ebp - 0x118], ebx
jbe 0x50b09b
cmp dword [ebp - 0x118], 1
setne bl
inc ebx
jmp 0x50b09b
cmp eax, 6
jne 0x50b080
cmp byte [ebp - 6], 1
jne 0x50b07b
mov eax, dword [ebp - 0x118]
sub eax, ebx
je 0x50b077
sub eax, 1
je 0x50b073
push 7
jmp 0x50b07d
push 5
jmp 0x50b07d
push 3
jmp 0x50b07d
push 4
pop ebx
jmp 0x50b09b
push 0xa
pop ecx
cmp eax, ecx
jne 0x50b098
cmp dword [ebp - 0x114], 0x55f0
sbb ebx, ebx
add ebx, 9
jmp 0x50b09b
cmova ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00468d3e
leave
ret

Function at 0x50c6a5
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x50ce81
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00530310
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push str._s__u___s_
push eax
call fcn.004f1a80
add esp, 0x18
lea eax, [ebp - 0x20c]
push esi
push esi
push eax
push 0x6d3528
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
call fcn.00402630
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00468d3e
leave
ret 0x18
Function at 0x50cf54
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.kernel32.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x50cfd9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6d3480
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
je 0x50cfd9
push str.RegDisableReflectionKey
push eax
call edi
push str.RegEnableReflectionKey
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
jmp 0x50cfdb
xor eax, eax
pop edi
pop esi
ret

Function at 0x50e8da
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x6bf26a
call fcn.0057109f
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.0050e5e4
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x50e90c
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x6d36a4
call fcn.00403320
push 0x6d36a8
mov ecx, esi
call fcn.00403320
push 0x741a3c
mov ecx, esi
call fcn.00403320
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.004032b0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x50e961
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x50e9f9
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00530310
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0050e4b8
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x50e9b8
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00403320
push 0x741a3c
mov ecx, esi
call fcn.00403320
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.004032b0
cmp dword [esi + 0x14], 8
jb 0x50ea01
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x50ea19
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x6d36a4
call fcn.00403320
push 0x6d36a8
mov ecx, esi
call fcn.00403320
push 0x741a3c
mov ecx, esi
call fcn.00403320
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.0050e643
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0041f4f0
lea ecx, [ebp - 0x248]
call fcn.00402630
lea ecx, [ebp - 0x230]
call fcn.00402630
call fcn.00571049
ret
Function at 0x50ff58
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x6bf438
call fcn.0057109f
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x50ff79
push dword [esi + 0x1c]
call fcn.0054bb3d
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0050f469
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.0054abfd
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x50fffd
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0050f469
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0050f469
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.00402630
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00402630
sub edi, 1
jns 0x50ffa7
mov ecx, esi
call fcn.0050fe37
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.00402630
call fcn.00571049
ret

Function at 0x510016
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x6bf438
call fcn.0057109f
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x510037
push dword [esi + 0x1c]
call fcn.0054bb3d
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0050f469
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.0054abfd
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x5100bb
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0050f469
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0050f469
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.00402630
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00402630
sub edi, 1
jns 0x510065
mov ecx, esi
call fcn.0050fece
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.00402630
call fcn.00571049
ret
Function at 0x5105f6
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x510666
push ebx
push esi
push esi
push 0x741954
push esi
push esi
push dword [ebp + 0x10]
push 1
push 2
push 0x110
push 0xf01ff
push dword [ebp + 8]
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
je 0x51065c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
inc esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x51066c
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 7
pop ecx
push 0xf003f
push eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x5106df
push 0x10020
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x5106cf
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x5106cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x5106df
push esi
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.00468d3e
leave
ret 4
Function at 0x5106f2
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x3c], edi
test edi, edi
jne 0x510726
xor eax, eax
jmp 0x5108a4
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x510742
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x51071f
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x510893
cmp dword [ebp - 0x24], 1
je 0x51076e
cmp dword [ebp - 0x24], 3
jne 0x510893
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0xa
jmp 0x5107e8
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0x34]
cmp eax, 0x3e8
jae 0x51079e
mov eax, 0x3e8
jmp 0x5107a3
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x510893
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x14], eax
jbe 0x5107da
call ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
jmp 0x5107e8
call ebx
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x10]
ja 0x510893
cmp dword [ebp - 0x24], 3
mov ecx, 0x2710
je 0x510788
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x510893
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x510893
call ebx
cmp dword [ebp - 0x24], 2
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
jne 0x51088e
mov edi, ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x510844
mov eax, ecx
jmp 0x51084e
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x51088b
cmp dword [ebp - 0x14], edi
jbe 0x51087b
call ebx
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
jmp 0x510885
call ebx
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x10]
ja 0x51088b
cmp dword [ebp - 0x24], 2
je 0x51082d
mov edi, dword [ebp - 0x3c]
xor ebx, ebx
inc ebx
jmp 0x510895
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00468d3e
leave
ret 4
Function at 0x5108b4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x5108ca
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00510a77
pop ecx
pop ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x5108ec
cmp esi, 2
je 0x5108ec
xor al, al
jmp 0x5108ee
mov al, 1
pop esi
pop ebp
ret

Function at 0x5108f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x6bf4ce
call fcn.0057106b
and dword [ebp - 0x20], 0
xor eax, eax
mov ebx, dword [ebp + 8]
and dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
and dword [ebp - 4], eax
push 0x208
mov dword [ebp - 0x20], 1
call fcn.00468fb0
mov edx, eax
xor eax, eax
pop ecx
mov ecx, 0x82
mov dword [ebp - 0x14], edx
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, 0x20019
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x5109f7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x5109ee
cmp dword [ebp - 0x10], 0x104
jbe 0x5109bf
push dword [ebp - 0x14]
call fcn.00468fb9
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00468fb0
mov edi, eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x14], edi
push eax
push esi
push edi
call fcn.0041fbc0
add esp, 0x14
jmp 0x5109c2
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov ecx, ebx
mov esi, eax
push edi
call fcn.00402440
push edi
call fcn.00468fb9
mov edi, dword [ebp - 0x1c]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop eax
cmp esi, eax
jne 0x510a19
cmp dword [ebp + 0xc], reloc.OLEAUT32.dll_SysReAllocString
jne 0x510a19
cmp edi, 0x20019
jne 0x510a19
mov edi, 0x20119
jmp 0x51093e
mov eax, ebx
call fcn.00571034
ret
Function at 0x510bc1
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x224
mov eax, 0x6bf521
call fcn.0057109f
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00530310
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x510c65
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402590
push 0x741a3c
lea ecx, [ebp - 0x230]
call fcn.00403320
push edi
lea ecx, [ebp - 0x230]
call fcn.00403320
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00512047
pop ecx
inc esi
lea ecx, [ebp - 0x230]
call fcn.00402630
mov eax, esi
call fcn.00571049
ret 4

Function at 0x510c7a
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x258
mov eax, 0x6bf55f
call fcn.0057109f
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], cx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.004033d0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push ebx
push eax
call fcn.00530310
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push dword [ebp + 0x14]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x510d02
push 0x741954
mov ecx, edi
call fcn.004033d0
jmp 0x510dda
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402590
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
dec eax
push eax
call fcn.0050a4b7
cmp word [eax], 0x5c
je 0x510d3d
push 0x741a3c
lea ecx, [ebp - 0x230]
call fcn.00403320
push esi
lea ecx, [ebp - 0x230]
call fcn.00403320
xor eax, eax
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
lea ecx, [ebp - 0x260]
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x238]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x24c], 7
push eax
call fcn.00404f90
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.00462b40
lea ecx, [ebp - 0x260]
mov esi, eax
call fcn.00402630
test esi, esi
je 0x510dcc
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x230]
push eax
call fcn.004032b0
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00403350
lea ecx, [ebp - 0x248]
call fcn.00402630
lea ecx, [ebp - 0x230]
call fcn.00402630
mov eax, edi
call fcn.00571049
ret 0x10