joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4593d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x471be4]
cmp dword [eax + 0x30], 0
je 0x459482
cmp dword [ebx + 0x94], 0
jne 0x45947c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459368
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45947c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x459442
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45947c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041808c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x459451
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459fe4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45a019
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404678
jmp 0x45a026
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45b090
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b0d1
mov eax, esi
call fcn.00441840
test al, al
je 0x45b0d1
mov eax, dword [ebx + 0x84]
call fcn.0044153c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b0d1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044153c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45c2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x45c3c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xaa
lea eax, [ebp - 0x20]
call fcn.00404588
mov eax, dword [ebp - 4]
call fcn.00404848
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0x80000001
jns 0x45c2f9
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x45c30a
lea eax, [ebp - 4]
mov edx, 0x45c3d4
call fcn.00404850
mov eax, dword [ebp - 4]
call fcn.00404848
sar eax, 1
jns 0x45c319
adc eax, 0
test eax, eax
jle 0x45c38b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x14]
add edx, edx
dec edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00404aa8
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x45c3e0
call fcn.00404894
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.0040308c
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0xc]
xor byte [ebp - 0x19], al
add dword [ebp - 0xc], 0x11
and dword [ebp - 0xc], 0xff
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0x19]
call fcn.00404770
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
call fcn.00404850
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x45c327
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.004045dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c3c8
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004045ac
lea eax, [ebp - 0x20]
call fcn.00404588
lea eax, [ebp - 4]
call fcn.00404588
ret

Function at 0x45c3e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.004093bc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004093a8
mov eax, dword [ebp - 0xc]
call fcn.00409408
mov esp, ebp
pop ebp
ret

Function at 0x45f1d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.0040271c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f241
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f248
mov eax, dword [ebp - 0xc]
call fcn.0040273c
ret
Function at 0x45f2d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x45f45e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
xor edx, edx
mov eax, 2
call fcn.0045e52c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x138], 0x128
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x10]
call fcn.0045e54c
mov dword [ebp - 0xc], eax
jmp 0x45f425
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004047f8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409044
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00408570
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408570
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404994
je 0x45f3f9
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x114]
mov ecx, 0x104
call fcn.004047f8
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00408570
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.00408570
mov edx, dword [ebp - 0x154]
pop eax
call fcn.00404994
jne 0x45f414
push 0
mov eax, dword [ebp - 0x130]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x10]
call fcn.0045e56c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45f354
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f465
lea eax, [ebp - 0x154]
mov edx, 7
call fcn.004045ac
lea eax, [ebp - 4]
call fcn.00404588
ret

Function at 0x4625b8
Capabilities:
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46267f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x400
mov eax, dword [ebp - 8]
call fcn.004093bc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x462607
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004093a8
jmp 0x462656
call fcn.00460f50
test al, al
je 0x462644
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0x46268c
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x46263a
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x410]
call fcn.004093a8
jmp 0x462656
lea eax, [ebp - 0xc]
call fcn.00404588
jmp 0x462656
lea ecx, [ebp - 0xc]
mov edx, 0x4626a0
mov eax, 0x4626b4
call fcn.00460e24
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.004045dc
mov eax, dword [ebp - 0x10]
call fcn.00409408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462686
lea eax, [ebp - 0xc]
call fcn.00404588
ret
Function at 0x462904
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404588
call fcn.00460f50
test al, al
je 0x462949
push 0x400
lea eax, [ebp - 0x404]
push eax
push 0x462950
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
je 0x462949
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x404]
call fcn.004093a8
mov esp, ebp
pop ebp
ret

Function at 0x4629fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x462b64
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040907c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408570
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404848
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.00404aa8
mov eax, dword [ebp - 0x1c]
mov edx, 0x462b78
call fcn.00404994
jne 0x462a7a
lea eax, [ebp - 0x1c]
mov edx, 0x462b84
call fcn.00404620
mov eax, dword [ebp - 0x1c]
call fcn.00404a48
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408f7c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00404620
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x462af4
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x462b94
call fcn.00404894
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x41577c]
call fcn.0040c328
call fcn.00403f40
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
call fcn.0041ace8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x471668]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0041a7cc
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040730c
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462b6b
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004045ac
lea eax, [ebp - 4]
call fcn.00404588
ret
Function at 0x464484
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x464534
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x464519
push 0x10
mov eax, dword [ebp - 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4644f0
mov byte [ebp - 9], 0
jmp 0x464510
mov eax, 0x464544
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46453b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045ac
ret

Function at 0x464548
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4645f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4645d5
push 0x20
mov eax, dword [ebp - 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4645b4
mov byte [ebp - 9], 0
jmp 0x4645cc
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4645f7
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045ac
ret
Function at 0x464600
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x464668
push 4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x46465f
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x464656
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x465168
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404a38
xor eax, eax
push ebp
push 0x4651f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404a48
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4651ba
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404a48
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
mov ax, word [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4651fd
lea eax, [ebp - 8]
call fcn.00404588
ret
Function at 0x466500
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4666ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402aa4
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x466554
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x46656e
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x466573
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x80], 0
jne 0x466586
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x466597
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00404a48
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x7c]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00465a8c
mov eax, dword [ebp - 0x24]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.00404a48
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.0045bdc4
mov eax, dword [ebp - 0x28]
call fcn.00404a48
push eax
mov eax, dword [ebp - 4]
call fcn.00465c38
push eax
mov eax, dword [ebp - 4]
call fcn.00465bf4
push eax
mov eax, dword [ebp - 4]
call fcn.00465b8c
push eax
push 0xf01ff
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004658d4
mov eax, dword [ebp - 0x2c]
call fcn.00404a48
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x90], edx
cmp dword [ebp - 0x10], 0
jne 0x466642
call fcn.0040da38
xor eax, eax
push ebp
push 0x4666c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x466687
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x46667d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4666ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4666cc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x466700
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x46672c
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xb4]
call dword [ebx + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404a48
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x466754
call fcn.0040da38
xor eax, eax
push ebp
push 0x46678b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x466774
call fcn.0040da38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466792
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x59307e60
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x29134e56
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40b728
Capabilities:
Check if file exists
Terminate process

Disassembly:
push 0
mov eax, 0x46b6bc
call fcn.004438a7
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor edi, edi
push ebx
cmp dword [esi + 0xc], edi
je 0x40b7f0
push str.360zipExt.dll
call fcn.0043f899
pop ecx
pop ecx
test eax, eax
je 0x40b7e6
push ebx
push str.MenuMgr.exe
call fcn.0043f899
pop ecx
pop ecx
test eax, eax
je 0x40b7e6
cmp dword [esi + 0x10], edi
jne 0x40b781
push ebx
push str.msvcp60.dll
call fcn.0043f899
pop ecx
pop ecx
test eax, eax
je 0x40b7e6
lea eax, [ebp + 8]
push ebx
lea ecx, [esi + 8]
push eax
call fcn.00406b10
pop ecx
pop ecx
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b7db
lea eax, [ebp + 0x14]
push ebx
lea ecx, [esi + 4]
push eax
call fcn.00406b10
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp + 0x18], edi
je 0x40b7fa
push 0x4760d0
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40b7d0
mov ebx, dword [ebp + 0x14]
call fcn.0041ed88
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.004031f6
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004031f6
xor eax, eax
call fcn.0044397f
ret 0x14
push str.360zipExt64.dll
jmp 0x40b760
mov ebx, dword [ebp + 0x14]
call fcn.0041ed88
push dword [esi + 0x14]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0x14]
call fcn.00402445
pop ecx
pop ecx
push 3
pop ecx
cmp eax, ecx
jne 0x40b822
mov dword [0x48818c], ecx
jmp 0x40b7d0
cmp eax, 2
jne 0x40b7d0
cmp dword [0x487d40], edi
jne 0x40b870
mov ecx, 0x485f6c
lea esi, [ebp + 0x18]
call fcn.00402b4a
mov byte [ebp - 4], 2
push dword [ebp + 0x14]
mov eax, esi
push 0x4760d8
push eax
call fcn.00402e53
mov esi, dword [ebp + 0x18]
add esp, 0xc
push 0x10000
push 0x47610c
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esi - 0x10]
call fcn.004031f6
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40b879
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
add esi, 8
mov eax, esi
call fcn.0040b609
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b8a7
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x40b8a7
mov ecx, dword [esi]
call fcn.00416dba
xor eax, eax
pop esi
ret 8

Function at 0x40b8e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 8
push 0
push edi
call fcn.0043e330
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40b931
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b930
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ebx
inc eax
pop ebx
pop esi
pop ebp
ret 0xc