joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e58c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdac
push ebx
push esi
mov ebx, eax
mov byte [ebp - 1], 0
cmp dword [0x4adef0], 0
je 0x49e5b5
mov eax, dword [0x4adef0]
movzx eax, byte [eax + 0x84]
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x49e707
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4adef0], 0
je 0x49e5d8
xor edx, edx
mov eax, dword [0x4adef0]
call fcn.004a12cc
mov esi, 0x5c
push 0
lea eax, [ebp - 0x60]
push eax
push esi
push 0x1f
call sub.user32.dll_MapVirtualKeyW
test eax, eax
je 0x49e604
lea eax, [ebp - 0x60]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [ebx + 0x7c]
call fcn.00467ab8
jmp 0x49e615
push 0xd
call sub.gdi32.dll_GetStockObject
mov edx, eax
mov eax, dword [ebx + 0x7c]
call fcn.00467ab8
mov esi, 0x1f4
mov dword [ebp - 0x254], esi
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0x29
call sub.user32.dll_MapVirtualKeyW
test eax, eax
je 0x49e680
lea eax, [ebp - 0x118]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [ebx + 0x78]
call fcn.00467ab8
lea eax, [ebp - 0x174]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [ebx + 0x80]
call fcn.00467ab8
lea eax, [ebp - 0xbc]
push eax
call sub.gdi32.dll_CreateFontIndirectW
mov edx, eax
mov eax, dword [ebx + 0x84]
call fcn.00467ab8
jmp 0x49e6b5
mov eax, dword [ebx + 0x78]
mov edx, 8
call fcn.00467bec
push 0xd
call sub.gdi32.dll_GetStockObject
mov edx, eax
mov eax, dword [ebx + 0x80]
call fcn.00467ab8
push 0xd
call sub.gdi32.dll_GetStockObject
mov edx, eax
mov eax, dword [ebx + 0x84]
call fcn.00467ab8
mov eax, dword [ebx + 0x78]
mov edx, 0xff000017
call fcn.0046785c
mov eax, dword [ebx + 0x80]
mov edx, 0xff000007
call fcn.0046785c
mov eax, dword [ebx + 0x84]
mov edx, 0xff000008
call fcn.0046785c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e70e
cmp dword [0x4adef0], 0
je 0x49e706
movzx edx, byte [ebp - 1]
mov eax, dword [0x4adef0]
call fcn.004a12cc
ret

Function at 0x49ebb8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x88], 0
je 0x49ebde
mov eax, dword [ebp - 4]
or word [eax + 0x8a], 0x10
jmp 0x49ec38
mov eax, dword [ebp - 4]
call fcn.0049e714
xor eax, eax
push ebp
push 0x49ec31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call sub.user32.dll_MapVirtualKeyW
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049eb30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ec38
mov eax, dword [ebp - 4]
and word [eax + 0x8a], 0xffef
mov eax, dword [ebp - 4]
call fcn.0049e71c
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ee70
Capabilities:
Log keystrokes

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, 8
mov dword [esp], ebx
push 0
lea eax, [esp + 4]
push eax
push ebx
push 0x48
call sub.user32.dll_MapVirtualKeyW
test eax, eax
je 0x49ee99
cmp dword [esp + 4], 0
setne al
jmp 0x49ee9b
xor eax, eax
pop ecx
pop edx
pop ebx
ret
Function at 0x49eea0
Capabilities:
Log keystrokes

Disassembly:
add esp, 0xfffffff8
mov dword [esp], 8
cmp al, 1
cmc
sbb eax, eax
mov dword [esp + 4], eax
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 0x49
call sub.user32.dll_MapVirtualKeyW
pop ecx
pop edx
ret
Function at 0x49f028
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x49f03f
add esp, 0xfffffff0
call fcn.00403fa0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042321c
mov eax, dword [0x4a6e34]
cmp byte [eax], 0
jne 0x49f06c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4a7238]
cmp word [eax + 2], 0
jne 0x49f086
mov eax, dword [0x4a7238]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a0c90
mov eax, dword [0x4a739c]
cmp word [eax + 2], 0
jne 0x49f0a0
mov eax, dword [0x4a739c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a0ea0
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x465bf0]
call fcn.00467670
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4a1324
mov dl, 1
mov eax, dword [0x418aa4]
call fcn.00403b38
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x418aa4]
call fcn.00403b38
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x466448]
call fcn.0046d094
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x49f27c
mov eax, dword [0x4a7084]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, eax
mov eax, esi
call fcn.0046d498
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4a15d4
mov dl, 1
mov eax, dword [0x418aa4]
call fcn.00403b38
mov dword [ebx + 0x94], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4a7084]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_SetThreadLocale
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040c0c0
test eax, eax
je 0x49f1ae
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040be6c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040c0a8
test eax, eax
je 0x49f1c6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.0040823c
push eax
call fcn.00408234
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.004057a4
push ebx
push 0x4a092c
call fcn.00495880
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4a6e34]
cmp byte [eax], 0
jne 0x49f217
mov eax, ebx
call fcn.0049f3f0
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.004a17fc
mov eax, ebx
call fcn.004a23c0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x49f274
call fcn.00403ff8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0d14
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004a21c4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a0d44
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x170]
jmp 0x4a0d47
mov ebx, dword [ebp - 0x10]
push 2
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x4a71d0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x14], eax
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
mov eax, dword [0x4a71d0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x4a0ddf
mov dword [ebp - 0x48], 0x28
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x4a7070]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_FindWindowExW
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub ecx, edx
sar ecx, 1
jns 0x4a0db9
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
sub edx, eax
sar edx, 1
jns 0x4a0dcb
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_LoadBitmapW
mov eax, dword [ebp - 0x10]
call fcn.0049558c
mov dword [ebp - 0x20], eax
call fcn.004953e0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.0049fac4
test al, al
je 0x4a0e04
or esi, 0x100000
xor ecx, ecx
push ebp
push 0x4a0e8b
push dword fs:[ecx]
mov dword fs:[ecx], esp
push esi
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call sub.user32.dll_GetMenuItemInfoW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e92
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x4a0e71
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
sub ecx, edx
sar ecx, 1
jns 0x4a0e4b
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
sub edx, eax
sar edx, 1
jns 0x4a0e5d
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_LoadBitmapW
mov eax, dword [ebp - 0x20]
call fcn.00495650
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 0x1c]
call fcn.004953e8
ret
Function at 0x4a16d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_GetKeyNameTextW
cmp eax, 1
sbb eax, eax
inc eax
cmp al, byte [0x4a6e04]
jne 0x4a176e
cmp bl, byte [0x4a6e04]
je 0x4a176e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xcf], 0
je 0x4a1740
cmp byte [0x4a6e04], 0
jne 0x4a1740
push 0xffffffffffffffec
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x170]
push esi
call sub.user32.dll_FillRect
or eax, 0x8000000
push eax
push 0xffffffffffffffec
mov eax, dword [ebp + 8]
push esi
call sub.user32.dll_IsZoomed
movzx eax, bl
movzx eax, word [eax*2 + 0x4a6e08]
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_LoadBitmapW
mov byte [0x4a6e04], bl
pop esi
pop ebx
pop ebp
ret
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
xor ebx, ebx
push edi
push ebx
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x401034
pop edi
pop ebx
add esp, 0x128
ret
push ebp
mov ebp, dword [esp + 0x138]
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push ecx
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x40108b
mov esi, ebp
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40107e
test cl, cl
je 0x40107a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40107e
add eax, 2
add esi, 2
test cl, cl
jne 0x40105a
xor eax, eax
jmp 0x401083
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40103d
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x128
ret
Function at 0x401630
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x408322
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push ebx
push ebp
push esi
mov dword [esp + 0xc], 0
push 0
push 0
push 0
mov ebx, 1
push 0
push str.GOOGLE
mov dword [esp + 0x430], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
jne 0x401694
mov esi, dword [esp + 0x424]
push str.error
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
jmp 0x4016d2
mov eax, dword [esp + 0x428]
push 0
push 0x80000000
push 0
push 0
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x4016ea
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [esp + 0x424]
push str.error
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x428]
mov byte [esp + 0x41c], 0
call sub.MFC42.DLL_CString::CString
mov eax, esi
jmp 0x40175c
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push 0x3ff
push edx
push esi
call edi
cmp eax, ebx
mov eax, dword [esp + 0x14]
jne 0x40171e
test eax, eax
je 0x401722
jmp 0x4016fe
test eax, eax
jne 0x4016fe
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
mov esi, dword [esp + 0x428]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x42c]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x420], 0
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
mov ecx, dword [esp + 0x414]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret
Function at 0x401780
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x408345
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x284
push ebp
push esi
push edi
mov ecx, dword [esp + 0x2a0]
lea eax, [esp + 0x150]
push eax
push ecx
mov dword [esp + 0x2a0], 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebp, eax
mov ecx, 0x50
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x158]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x164]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x16c]
mov edx, dword [esp + 0x150]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x170]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
lea edi, [esp + 0x17c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x15c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x168]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x174]
not ecx
sub edi, ecx
mov dword [esp + 0x34], edx
lea edx, [esp + 0x3c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x140]
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x280]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
lea ecx, [esp + 0x14]
mov eax, 0xb
push ecx
mov word [esi], 0x7d4
mov word [esi + 2], ax
mov word [esi + 6], 0xf
mov word [esi + 8], 0xc
mov word [esi + 0xa], 0x15
mov word [esi + 0xc], ax
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
call edi
lea edx, [esp + 0x1c]
push edx
push esi
call edi
lea eax, [esp + 0x24]
push eax
push esi
call edi
push 0x10
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x298], 1
je 0x40190d
mov ecx, eax
call sub.MFC42.DLL_CFile::CFile
mov esi, eax
jmp 0x40190f
xor esi, esi
mov eax, dword [esp + 0x2a0]
mov edx, dword [esi]
push 0
push 2
push eax
mov ecx, esi
mov byte [esp + 0x2a4], 0
call dword [edx + 0x28]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x54]
push ebp
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x2a0]
mov dword [esp + 0x298], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x290]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x290
ret
Function at 0x405070
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x4050be
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4050be
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov edx, dword [eax]
cmp edx, 0x4550
jne 0x4050be
mov edx, dword [esp + 0xc]
add eax, 4
mov dword [ecx], eax
add eax, 0x14
mov dword [edx], eax
cmp word [eax], 0x10b
jne 0x4050be
mov ecx, dword [esp + 0x10]
add eax, 0xe0
mov dword [ecx], eax
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4053a0
Capabilities:
Create service
Start service

Disassembly:
push esi
push edi
push 2
push 0
push 0
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40543c
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 3
push 1
push 0x10
push str.RESSDT
push str.RESSDT
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x431
jne 0x405402
push 0x10
push str.RESSDT
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
push ebx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..RESSDTDOS
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x405490
Capabilities:
Create service

Disassembly:
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0x10]
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push 1
push 3
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4054c0
ret
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
ret

Function at 0x405540
Capabilities:
Check os version

Disassembly:
sub esp, 0x40
call dword [sym.imp.KERNEL32.DLL_GetVersion]
and eax, 0xff
cmp eax, 5
jb 0x405564
mov eax, dword [esp + 0x44]
lea ecx, [esp]
push eax
push str..Global_s
push ecx
jmp 0x405573
mov edx, dword [esp + 0x44]
lea eax, [esp]
push edx
push str.._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
jne 0x4055a4
xor eax, eax
add esp, 0x40
ret
mov ecx, dword [esp + 0x48]
test ecx, ecx
je 0x4055b7
mov dword [ecx], eax
mov eax, 1
add esp, 0x40
ret
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
add esp, 0x40
ret
Function at 0x405630
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
mov eax, dword [0x40cdf0]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], 0
je 0x40567e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, 0x27
xor eax, eax
lea edi, [ebp - 0xd4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd4]
mov edi, 0x9c
push eax
mov dword [ebp - 0xd4], edi
call esi
test eax, eax
jne 0x4056c6
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x94
push ecx
call esi
test eax, eax
je 0x4057f3
mov eax, dword [ebp - 0xc4]
sub eax, 2
jne 0x4057f3
mov eax, dword [ebp - 0xd0]
cmp eax, 4
jne 0x40571d
mov eax, dword [ebp - 0xcc]
test eax, eax
jne 0x4057f3
mov edi, 0x94
mov ebx, 0x98
mov dword [ebp - 0x28], 0x108
mov dword [ebp - 0x24], 0x34
mov dword [ebp - 0x1c], 0x50
mov dword [ebp - 0x20], 0x30
mov dword [ebp - 0x14], 0x48
jmp 0x405790
cmp eax, 5
jne 0x4057f3
mov eax, dword [ebp - 0xcc]
test eax, eax
jne 0x40575a
mov ebx, 0xa0
mov dword [ebp - 0x28], 0x12c
mov dword [ebp - 0x24], 0x44
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x14], 0x58
jmp 0x405790
cmp eax, 1
jne 0x4057f3
mov edi, 0x84
mov ebx, 0x88
mov dword [ebp - 0x28], 0xc8
mov dword [ebp - 0x24], 0x54
mov dword [ebp - 0x1c], 0x74
mov dword [ebp - 0x20], 0x4c
mov dword [ebp - 0x14], 0x68
push 0x40ccec
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_2
push 0x40c608
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x2c]
push edx
push eax
push ecx
push str.Nessery
call fcn.004055d0
mov eax, dword [ebp - 0x2c]
add esp, 0x10
cmp eax, 0xffffffff
je 0x4057e7
push 0x20
push 1
mov dword [0x40c878], eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x405807
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x14], ecx
lea ecx, [ebp - 0x30]
push 0
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x14]
push ecx
push 0
push 0
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], 0x18
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov edx, dword [0x40c878]
push 0x20
push esi
push 0x2a7b8004
push edx
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x40585b
push eax
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x40cdf0], 1
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405bf0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x14], edi
mov ebp, 0x1000
mov ebx, 0x7a
test ebx, ebx
je 0x405c67
cmp ebx, 0x7a
je 0x405c1f
mov dword [esp + 0x14], 1
jmp 0x405cab
push esi
call sub.MFC42.DLL_operatordelete
push ebp
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 8
test edi, edi
mov dword [esi], ebp
mov dword [esp + 0x10], ebp
jne 0x405c52
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x405c5f
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x405c93
xor ebx, ebx
jmp 0x405c9f
test dword [esi + 0xc], 0x100000
jne 0x405c7a
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x405c93
xor ebx, ebx
jmp 0x405c9f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, dword [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405c09
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
test edi, edi
je 0x405cbf
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405c09
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret