joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3f54
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404edc
lea ebx, [ebp - 0x40]
xor eax, eax
push ebp
push 0x4d3ff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404eec
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 4], 0x44c
mov eax, 0x4d4004
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x38], eax
xor eax, eax
mov dword [ebx + 0x28], eax
push ebx
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3ffa
lea eax, [ebp - 4]
call fcn.00404a2c
ret

Function at 0x4d4010
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4122
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov edx, 0x4d413c
call fcn.00404ac4
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.00404eec
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d410c
mov eax, dword [ebp - 0xc]
call fcn.004027e0
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4d4105
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4d40ec
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4d40ec
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x1c]
movzx edx, word [eax + 0xa]
imul edx, edx, 0x2710
jno 0x4d40c6
call fcn.00403b58
movzx ecx, word [eax + 8]
imul ecx, ecx, 0x64
jno 0x4d40d4
call fcn.00403b58
add edx, ecx
jno 0x4d40dd
call fcn.00403b58
movzx eax, word [eax + 0xe]
add edx, eax
jno 0x4d40ea
call fcn.00403b58
mov dword [esi], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d410c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00402800
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4129
lea eax, [ebp - 0x14]
call fcn.00404a2c
ret
Function at 0x4d5bdc
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x54471c]
cmp dword [eax], 2
je 0x4d5bf9
mov byte [ebp - 1], 1
jmp 0x4d5dd3
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x543f98
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4d5dd3
xor eax, eax
push ebp
push 0x4d5dcc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
and eax, 0xff
cmp ax, 5
jb 0x4d5c5b
push 0x4d5ddc
push 0x4d5df4
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4d5c82
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4d5db5
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4d5db5
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4d5cd3
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4d5cb4
call fcn.00404490
jmp 0x4d5dd3
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4d5cd3
call fcn.00404490
jmp 0x4d5dd3
xor eax, eax
push ebp
push 0x4d5dae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4d5d16
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x4d5d16
call fcn.00404490
call fcn.00404490
jmp 0x4d5dd3
mov eax, dword [ebp - 0x14]
call fcn.004027e0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4d5d4b
call fcn.00404490
call fcn.00404490
jmp 0x4d5dd3
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
sub esi, 1
jae 0x4d5d5a
call fcn.00403b58
test esi, esi
jl 0x4d5d8f
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4d5d8b
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4d5d8b
mov byte [ebp - 1], 1
jmp 0x4d5d8f
inc ebx
dec esi
jne 0x4d5d61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5db5
mov eax, dword [ebp - 0x18]
call fcn.00402800
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5dd3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d63c4
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
shl ebx, 6
add ebx, 0x3f
test ebx, ebx
js 0x4d63eb
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4d63e4
mov edx, esp
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d6555
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x4d653a
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403254
mov word [ebp - 0x28], 2
sub bl, 0x14
je 0x4d6443
dec bl
je 0x4d6452
dec bl
je 0x4d6461
dec bl
je 0x4d6470
jmp 0x4d653a
lea eax, [ebp - 0x10]
mov edx, 0x4d6574
call fcn.00404ac4
jmp 0x4d647d
lea eax, [ebp - 0x10]
mov edx, 0x4d6598
call fcn.00404ac4
jmp 0x4d647d
lea eax, [ebp - 0x10]
mov edx, 0x4d65b8
call fcn.00404ac4
jmp 0x4d647d
lea eax, [ebp - 0x10]
mov edx, 0x4d65d4
call fcn.00404ac4
mov eax, dword [ebp - 4]
test eax, eax
jl 0x4d6534
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00404c90
mov eax, dword [ebp - 8]
call fcn.00404eec
mov ebx, eax
mov eax, ebx
call fcn.004c21e0
test al, al
jne 0x4d64c8
mov eax, ebx
lea edx, [ebp - 0xc]
call fcn.004c2638
test al, al
je 0x4d6524
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00409114
mov word [ebp - 0x28], 2
mov eax, dword [ebp - 8]
call fcn.00404eec
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x24], eax
mov esi, 5
mov ebx, dword [0x54411c]
mov ax, word [ebx]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
push 0x10
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404cec
push eax
lea eax, [ebp - 0x10]
call fcn.00404f44
push eax
push edi
call sub.wsock32.dll_sendto
push 1
call sub.kernel32.dll_Sleep_1
add ebx, 2
dec esi
jne 0x4d64ea
add dword [ebp - 0x18], 0x100
dec dword [ebp - 0x14]
jne 0x4d648f
push edi
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d655c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a50
ret
Function at 0x4d7cdc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
push ebp
push 0x4d7d7f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x4d7d8c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x4d7d71
mov eax, dword [0x5446e8]
mov eax, dword [eax]
movzx eax, byte [eax + 0x7a]
mov dword [ebp - 8], eax
mov eax, 4
mov edx, 4
push edx
lea edx, [ebp - 8]
push edx
push eax
push 0
push 0x4d7da8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x5446e8]
mov eax, dword [eax]
movzx eax, word [eax + 0x76]
mov dword [ebp - 8], eax
mov eax, 4
mov edx, 4
push edx
lea edx, [ebp - 8]
push edx
push eax
push 0
push 0x4d7db4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7d86
ret

Function at 0x4da9d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4dab52
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00409ce8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040eda4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x4dab68
call fcn.00404d38
mov eax, dword [ebp - 4]
call fcn.00409a2c
test al, al
jne 0x4daa38
mov eax, dword [ebp - 4]
call fcn.00409f34
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040eda4
mov edx, dword [ebp - 0x18]
mov ecx, dword [0x5443b4]
mov ecx, dword [ecx]
lea eax, [ebp - 4]
call fcn.00404d38
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040988c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00404eec
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4dab2a
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
call fcn.0040b3f4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040cd50
push dword [ebp - 0x1c]
push 0x4dab74
push 0x4dab80
lea eax, [ebp - 0x20]
mov edx, dword [0x544428]
mov edx, dword [edx]
call fcn.00404c24
push dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404dac
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404cec
push eax
lea eax, [ebp - 8]
call fcn.00404f44
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
lea eax, [ebp - 8]
mov edx, 0x4dabac
call fcn.00404ac4
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404cec
push eax
lea eax, [ebp - 8]
call fcn.00404f44
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dab59
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404a50
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a50
ret
Function at 0x4db668
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
push 0xf003f
push 0
mov eax, ebx
call fcn.00404eec
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4db6ae
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
jmp 0x4db7fb
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4db6d6
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x4db7fb
xor eax, eax
push ebp
push 0x4db7f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, dword [ebp - 4]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
jne 0x4db710
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
call fcn.00404490
jmp 0x4db7fb
cmp edi, 0xffffffff
setne al
or al, byte [ebp + 0xc]
je 0x4db757
mov eax, dword [ebp - 8]
call fcn.00404eec
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push ebx
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0x4db757
push ebx
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
call fcn.00404490
jmp 0x4db7fb
cmp byte [ebp + 8], 0
je 0x4db7ce
mov eax, dword [0x544690]
cmp dword [eax], 0
je 0x4db7ce
mov eax, esi
call fcn.00404cec
add eax, 1
jno 0x4db778
call fcn.00403b58
call fcn.004027e0
mov edi, eax
mov dword [ebp - 0x14], edi
mov eax, esi
call fcn.00404cec
mov edx, eax
add edx, 1
jno 0x4db795
call fcn.00403b58
mov eax, edi
call fcn.00407af4
test esi, esi
je 0x4db7aa
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.0040a014
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
mov eax, dword [0x544690]
mov eax, dword [eax]
call eax
test al, al
jne 0x4db7c6
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
call fcn.00402800
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db7fb
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_UnlockServiceDatabase
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ddc0c
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004ddba8
test eax, eax
jle 0x4ddc5b
lea edx, [esi + 0x30]
xchg edx, eax
call fcn.00405078
mov eax, dword [esi + 0x30]
call fcn.00404cec
push eax
lea eax, [esi + 0x30]
call fcn.00404f44
pop edx
call fcn.00407af4
mov eax, esi
call fcn.004ddbcc
test eax, eax
jle 0x4ddcca
lea edx, [esi + 0x30]
xchg edx, eax
call fcn.00405078
mov bl, 1
jmp 0x4ddcca
mov eax, esp
call fcn.004a1d04
mov edx, esp
mov eax, dword [esi + 0x24]
call fcn.004a1cf4
lea eax, [esi + 0x28]
push eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x4ddcca
test eax, eax
je 0x4ddcca
mov eax, esi
call fcn.004ddba8
test eax, eax
je 0x4ddcca
lea edx, [esi + 0x30]
xchg edx, eax
call fcn.00405078
mov eax, dword [esi + 0x30]
call fcn.00404cec
push eax
lea eax, [esi + 0x30]
call fcn.00404f44
pop edx
call fcn.00407af4
mov eax, esi
call fcn.004ddbcc
test eax, eax
jle 0x4ddcca
lea edx, [esi + 0x30]
xchg edx, eax
call fcn.00405078
mov bl, 1
mov eax, ebx
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x4eef08
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4ef063
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x4ef045
push 0xf01ff
push 0x4ef074
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x4ef03f
xor ebx, ebx
lea eax, [ebp - 0x38]
call fcn.004c2b60
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x14]
mov ecx, 0x4ef084
call fcn.00404d38
mov eax, dword [ebp - 0x14]
call fcn.00409a2c
test al, al
jne 0x4eef8b
mov eax, dword [ebp - 0x14]
call fcn.00409a50
push dword [ebp - 0x14]
push 0x4ef094
push 0x4ef0a0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404dac
push 0
push 0x80
push 2
push 0
push 7
push 0xc0000000
mov eax, dword [ebp - 0x14]
call fcn.00404eec
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4ef012
mov dl, 1
mov eax, dword [0x419160]
call fcn.00403be8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0041ba68
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
call fcn.004c1ba8
mov ebx, eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_FlushFileBuffers
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
call fcn.00403c18
test bl, bl
je 0x4ef039
lea eax, [ebp - 0x34]
push eax
push 0xc8
push esi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4ef039
cmp dword [ebp - 0x30], 4
jne 0x4ef039
mov byte [ebp - 5], 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef06a
lea eax, [ebp - 0x38]
call fcn.00404a2c
lea eax, [ebp - 0x14]
call fcn.00404a2c
ret
Function at 0x4f2aa8
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [0x543fa8], eax
xor eax, eax
mov dword [0x543fa4], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [0x543fa8], eax
cmp dword [0x543fa8], 0
je 0x4f2bb8
push 0x34
push 0x4f2bc4
mov eax, dword [0x543fa8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [0x543fa4], eax
cmp dword [0x543fa4], 0
je 0x4f2bb8
xor eax, eax
mov dword [ebp - 8], eax
test bl, bl
je 0x4f2b44
mov eax, dword [0x54449c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x54449c]
mov dword [eax], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x543fa4]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4f2b5b
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [0x543fa4]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4f2bb8
cmp dword [ebp - 0xc], 0x3e8
jbe 0x4f2b83
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
fild qword [ebp - 0x2c]
fdiv dword [0x4f2bcc]
call fcn.00402c90
jmp 0x4f2b88
mov eax, 0x1e
mov dword [edi + 0xc], eax
test bl, bl
je 0x4f2b9e
push esi
push 0x4f2a80
mov eax, edi
call fcn.0043ac54
jmp 0x4f2bab
push esi
push 0x4f2a94
mov eax, edi
call fcn.0043ac54
mov dl, 1
mov eax, edi
call fcn.0043ac34
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4febb8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor edx, edx
push ebp
push 0x4fec2d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x368]
call fcn.00454858
mov ebx, eax
test ebx, ebx
je 0x4fec17
mov eax, ebx
call fcn.00451cf0
test al, al
jne 0x4fec17
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4fec17
mov ebx, eax
lea eax, [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.00404ac4
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404eec
push eax
push 0x4fec38
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fec34
lea eax, [ebp - 4]
call fcn.00404a2c
ret
Function at 0x50db78
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x50dcce
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x84]
call fcn.00409e04
lea eax, [ebp - 8]
mov ecx, 0x50dce8
mov edx, dword [ebx + 0x6c]
call fcn.00404d38
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404f4c
mov eax, dword [ebp - 0x14]
mov edx, 0x50dd04
call fcn.00404e38
je 0x50dbec
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x50dd04
call fcn.00404d38
cmp byte [ebx + 0x8c], 0
je 0x50dc2f
push 0
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404d38
mov eax, dword [ebp - 0x18]
call fcn.00404eec
push eax
mov eax, dword [ebx + 0x84]
call fcn.00404eec
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x50dc2f
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x50dcb3
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0x90], 0
je 0x50dcb3
jmp 0x50dca3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
mov dl, 1
mov eax, dword [ebx + 0x90]
call fcn.004c34b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
call fcn.00409114
cmp dword [ebp - 0x10], 0
je 0x50dca3
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00409e04
push 0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404d38
mov eax, dword [ebp - 0x20]
call fcn.00404eec
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404eec
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x50dca3
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x50dcb3
mov eax, dword [ebx + 0x90]
call fcn.00404cec
cmp eax, dword [ebp - 4]
jg 0x50dc3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dcd5
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404a50
ret
Function at 0x51f290
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404edc
mov eax, dword [ebp - 8]
call fcn.00404edc
xor eax, eax
push ebp
push 0x51f31e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51f2f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404eec
push eax
mov eax, dword [ebp - 4]
call fcn.00404eec
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51f303
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f325
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a50
ret
Function at 0x52a07c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
xor eax, eax
push ebp
push 0x52a195
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405078
lea eax, [ebp - 8]
call fcn.00404f44
push eax
push ebx
call sub.kernel32.dll_GetLogicalDriveStringsA
mov edx, dword [ebp - 8]
mov eax, 0x52a1ac
call fcn.00405030
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00404cec
mov ecx, eax
sub ecx, ebx
jno 0x52a0d7
call fcn.00403b58
add ecx, 1
jno 0x52a0e1
call fcn.00403b58
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404f8c
mov edx, dword [ebp - 8]
mov eax, 0x52a1b8
call fcn.00405030
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x44]
test ebx, ebx
jle 0x52a17a
lea eax, [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 1
jno 0x52a115
call fcn.00403b58
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404f4c
lea eax, [ebp - 0x10]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404f4c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408ec4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404ac4
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, 0x52a1b8
call fcn.00405030
mov ebx, eax
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 1
call fcn.00404f8c
test ebx, ebx
jg 0x52a105
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a19c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a50
ret