joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c50
Capabilities:
Copy file
Hide graphical window

Disassembly:
mov eax, 0x1044
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1040], eax
mov eax, dword [esp + 0x104c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov edi, edx
xor eax, eax
mov ebx, ecx
push 0x7fe
push eax
mov word [esp + 0x858], ax
lea eax, [esp + 0x85a]
push eax
call fcn.0048fb10
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x18
push 0
push 0
push 0x1004
push ebx
call esi
mov ebp, eax
test ebp, ebp
je 0x410e09
nop
lea eax, [esp + 0x850]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
dec ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0x400
push eax
push 0
push 0x1073
push ebx
call esi
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x400
call esi
push str.Directory
lea eax, [esp + 0x854]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
mov word [esp + 0x30], 0
lea eax, [esp + 0x50]
movq qword [esp + 0x24], xmm0
push eax
movups xmmword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x4e], 0x5c
jne 0x410d70
mov word [esp + eax*2 + 0x4e], cx
jmp 0x410d75
mov word [esp + eax*2 + 0x52], cx
mov eax, dword [0x4e6030]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1060]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov ax, word [esp + 0x1058]
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push 0
push 0x1008
push ebx
call esi
cmp dword [0x4e5c1c], 2
jne 0x410dec
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
cmp eax, 5
je 0x410dec
push 5
jmp 0x410dee
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x405
push edi
call esi
test ebp, ebp
jne 0x410cd0
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1044
ret
Function at 0x411ac0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x7c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x276f
push dword [0x4e6030]
call edi
push 0
push 0x27a7
push dword [0x4e6030]
mov ebp, eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push ebp
call esi
test eax, eax
je 0x411c2a
push 1
push 0x276c
push dword [0x4e6030]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 0x276b
push dword [0x4e6030]
call edi
push eax
call ebx
push 1
push 0x276d
push dword [0x4e6030]
call edi
push eax
call ebx
push 0xa
push 0xa
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0x1004
push ebp
call esi
push eax
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x4c]
push eax
push ecx
push dword [0x4d5834]
push dword [0x4d5830]
call fcn.00465af0
add esp, 0xc
mov edx, 0x4b3f94
mov ecx, str.FILE
push eax
call fcn.00478640
push eax
push 0x400
push 0x4d6040
call fcn.0040a420
add esp, 0x14
cmp dword [0x4e5c1c], 2
jne 0x411be9
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call edi
push eax
call esi
cmp eax, 5
je 0x411be9
push 0x4d6040
push 1
push 0x40b
push dword [0x4e5c10]
call esi
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0xb
push eax
push 0
push 0x102b
push ebp
mov dword [esp + 0x2c], 2
call esi
mov edx, 0x4b3f6c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
jmp 0x411d14
mov edx, 0x4b3f6c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call esi
mov edx, 0x4b3f3c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0x4d6040
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
cmp dword [0x4e5c1c], 2
jne 0x411c9f
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call edi
push eax
call esi
cmp eax, 5
je 0x411c9f
push 0x4d6040
push 1
push 0x40b
push dword [0x4e5c10]
call esi
push 0
push 0x276c
push dword [0x4e6030]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x276b
push dword [0x4e6030]
call edi
push eax
call ebx
push 0
push 0x276d
push dword [0x4e6030]
call edi
push eax
call ebx
push 0
push ebp
call ebx
push 0xaa
push 0
push 0x101e
push ebp
call esi
push 0x50
push 1
push 0x101e
push ebp
call esi
push 0x64
push 2
push 0x101e
push ebp
call esi
push 0x400
push 3
push 0x101e
push ebp
call esi
push 1
push 0x276a
push dword [0x4e6030]
mov dword [0x4cc1c8], 2
call edi
push eax
call ebx
push 1
push 0x2769
push dword [0x4e6030]
call edi
push eax
call ebx
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x7c
ret
Function at 0x41aad0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1088
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1084], eax
movups xmm0, xmmword [esp + 0x108c]
mov eax, dword [esp + 0x10c4]
push ebx
movups xmmword [esp + 0x10], xmm0
push ebp
movups xmm0, xmmword [esp + 0x10a4]
push esi
push edi
movups xmmword [esp + 0x2c], xmm0
push ecx
movups xmm0, xmmword [esp + 0x10c0]
mov edi, edx
mov dword [esp + 0x58], eax
push dword [0x4e6030]
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x20], edi
movq xmm0, qword [esp + 0x10d4]
movq qword [esp + 0x54], xmm0
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
push 0
push 0
push 0x1009
push ebx
call ebp
push 0x7fc
lea eax, [esp + 0x89c]
mov dword [esp + 0x898], 0x30
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x94]
xor esi, esi
push 0x4e5e28
push 0x400
push eax
push esi
lea eax, [esp + 0x8a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x41ac98
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [eax + eax]
movzx eax, word [esp + 0x94]
inc esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x14], esi
xor esi, esi
push eax
call edi
test eax, eax
jle 0x41abff
nop dword [eax]
nop word [eax + eax]
mov ax, word [esp + esi*2 + 0x96]
mov word [esp + esi*2 + 0x94], ax
lea eax, [esp + 0x94]
push eax
inc esi
call edi
cmp esi, eax
jl 0x41abe0
push 0
push 0
push 0x1004
push ebx
call ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x104d
push ebx
call ebp
cmp dword [esp + 0x10], 0x31
jne 0x41ac51
lea eax, [esp + 0x58]
mov dword [esp + 0x68], 0xf000
push eax
push dword [esp + 0x24]
mov dword [esp + 0x6c], 0x2000
push 0x102b
push ebx
call ebp
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x894]
push 0xa
push 0xa
push eax
push esi
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x94]
push 0x4e5e28
push 0x400
push eax
push 0
lea eax, [esp + 0x8a4]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x41abb0
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1088
ret
Function at 0x41b4f0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x12b4
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12ac], eax
push ebx
push ebp
push esi
push edi
push 0x27e1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x1009
push edi
call ebx
push 0x4e6040
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str._bkup
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41b69b
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [esp + 0x58]
push eax
push esi
call ebp
test eax, eax
je 0x41b694
nop dword [eax + eax]
test byte [esp + 0x58], 0x10
jne 0x41b684
push 0
push 0
push 0x1004
push edi
call ebx
push 0x4d6a20
push 0
mov dword [0x4d6a24], eax
lea eax, [esp + 0x8c]
push 0x104d
push edi
mov dword [0x4d6a34], eax
call ebx
push 0
push dword [esp + 0x7c]
mov dword [esp + 0x2c], 2
call fcn.00465af0
add esp, 8
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d6a24]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x2a8]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [esp + 0x2b2]
push eax
movzx eax, word [esp + 0x2b4]
push eax
movzx eax, word [esp + 0x2b0]
push eax
movzx eax, word [esp + 0x2b6]
push eax
movzx eax, word [esp + 0x2be]
push eax
push str._.2d._.2d._d__.2d:_.2d
lea eax, [esp + 0xad0]
push 0x400
push eax
call fcn.0040a420
add esp, 0x20
mov dword [esp + 0x24], 1
lea eax, [esp + 0xab8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
push eax
push dword [0x4d6a24]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x58]
push eax
push esi
call ebp
test eax, eax
jne 0x41b590
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x478350
push 1
push 0x1051
push edi
mov dword [0x4e5c18], 0
mov dword [0x4e5c14], edi
call ebx
mov ecx, dword [esp + 0x12bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x12b4
ret
Function at 0x41b6e0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1248
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1244], eax
push esi
push 0x7fc
lea eax, [esp + 0x250]
mov dword [esp + 0x24c], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0x248]
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e1
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
cmp word [esp + 0x248], 0
jne 0x41b7d7
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x40]
mov edx, 0x4b4850
push 0x30
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x1244]
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
push 0x4e6040
lea eax, [esp + 0xa4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa48]
push str._bkup_
push eax
call esi
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0xa4c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
lea eax, [esp + 0xa48]
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x4c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], str.notepad.exe
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x1248]
pop esi
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
Function at 0x41bcb0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1248
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1244], eax
push esi
push 0x7fc
lea eax, [esp + 0x250]
mov dword [esp + 0x24c], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0x248]
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
cmp word [esp + 0x248], 0
jne 0x41bda7
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x40]
mov edx, 0x4b48a4
push 0x30
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x1244]
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
push 0x4e6040
lea eax, [esp + 0xa4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa48]
push str.undo_
push eax
call esi
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0xa4c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
lea eax, [esp + 0xa48]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4c77d0]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x4c
mov dword [esp + 0x14], str.explore
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x1248]
pop esi
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
Function at 0x422b90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xd8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x27c0
push dword [0x4e6030]
mov dword [0x4cc1d4], 2
call edi
push 0
push 0x27ae
push dword [0x4e6030]
mov ebx, eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
add esp, 0xc
push 0xa
push 0x64
push eax
push 0
push 0
push 0x1004
push ebx
call esi
push eax
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x10]
mov edx, 0x4b56b4
mov ecx, 0x4b3c0c
push eax
call fcn.00478640
push eax
push 0x400
push 0x4d73c8
call fcn.0040a420
add esp, 0x10
mov edx, 0x4b5454
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call esi
push 0x4d73c8
push 1
push 0x40b
push dword [0x4e5c10]
call esi
push 0
push 0
push 0x1004
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
test eax, eax
jne 0x422c93
push 0
push ebx
call esi
xor ecx, ecx
jmp 0x422c98
mov ecx, 1
call fcn.004200f0
push 1
push 0x27b7
push dword [0x4e6030]
call edi
push eax
call esi
push 1
push 0x4f61
push dword [0x4e6030]
call edi
push eax
call esi
push 2
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x425ed0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1840
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x183c], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea eax, [esp + 0x10f4]
push 0x758
mov ecx, 0x2a
lea edi, [esp + 0x1050]
mov esi, str.http:__www.google.com_cse_cxpartner_pub_0006844798601315_3A9ir0bvrat38ieUTF_8q
mov ebx, edx
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048fb10
movups xmm0, xmmword [str.Regedit]
push 0x7f0
lea eax, [esp + 0x6c]
push 0
push eax
movups xmmword [esp + 0x64], xmm0
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x18
push 2
push 0xffffffffffffffff
push 0x100c
push ebp
call esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push ebp
mov dword [esp + 0x38], 0x400
call esi
lea edx, [esp + 0x4c]
mov ecx, edx
call fcn.0045e940
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x854], ax
lea eax, [esp + 0x856]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x58]
add esp, 0xc
push eax
lea eax, [esp + 0x850]
push eax
call esi
push 0
lea eax, [esp + 0x50]
push eax
push 0x400
push 0
lea eax, [esp + 0x85c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x425fdc
lea eax, [esp + 0x84c]
push eax
lea eax, [esp + 0x50]
push eax
call esi
push 0x4b3500
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x425ffb
add eax, 2
jmp 0x425fff
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x1040]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
push 0
lea eax, [esp + 0x1048]
push eax
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x183c]
xor ecx, esp
call fcn.0048ea75
add esp, 0x1840
ret
Function at 0x426050
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x103c], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, edx
push 0x7fe
push eax
mov word [esp + 0x50], ax
mov ebx, ecx
lea eax, [esp + 0x52]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call esi
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1073
push ebx
mov dword [esp + 0x34], 0x400
call esi
lea edx, [esp + 0x48]
mov ecx, edx
call fcn.0045e940
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x850], ax
lea eax, [esp + 0x852]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x54]
add esp, 0xc
push eax
lea eax, [esp + 0x84c]
push eax
call esi
push 0
lea eax, [esp + 0x4c]
push eax
push 0x400
push 0
lea eax, [esp + 0x858]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x42612e
lea eax, [esp + 0x848]
push eax
lea eax, [esp + 0x4c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x4c77d0]
push eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x4c
mov dword [esp + 0x1c], str.properties
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x1048]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1040
ret
Function at 0x42bac0
Capabilities:
Create service
Create thread

Disassembly:
mov eax, 0x1270
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1268], eax
push ebx
push ebp
push esi
push 0x800
lea eax, [esp + 0x274]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x10]
push 0x58
push 0
push eax
call fcn.0048fb10
mov eax, dword [0x4e5c0c]
add esp, 0xc
mov dword [esp + 0x18], eax
mov edx, 0x4b4af4
mov eax, dword [0x4e6030]
mov ecx, str.STRT
mov dword [esp + 0x10], 0x58
mov dword [esp + 0x44], 0x81824
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x4b5b10
call fcn.00478640
mov dword [esp + 0x40], eax
lea eax, [esp + 0x270]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x58], 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp word [esp + 0x270], 0
je 0x42bca7
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0xa78], ax
lea eax, [esp + 0xa7a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0xa74]
push eax
call ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x42bca7
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x284]
push eax
push 1
push 3
push 0x10
push 0xf01ff
lea eax, [esp + 0xa98]
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, eax
mov ecx, str.STRT
test ebp, ebp
jne 0x42bc4c
mov edx, 0x4b4024
call fcn.00478640
push eax
lea eax, [esp + 0x6c]
push eax
call ebx
lea eax, [esp + 0x68]
mov edx, 0x4b4afc
push 0x30
push eax
mov ecx, str.STRT
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42bc88
mov edx, 0x4b4894
call fcn.00478640
push eax
lea eax, [esp + 0x6c]
push eax
call ebx
lea eax, [esp + 0x68]
mov edx, 0x4b4b04
push 0x30
push eax
mov ecx, str.STRT
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x42ac20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x1274]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1270
ret
Function at 0x42bff0
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x228
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push 0xf01ff
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42c03d
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b4ca8
jmp 0x42c1d9
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42c0a8
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b4de0
lea eax, [esp + 0x20]
mov ecx, str.STRT
push 0x30
push eax
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0048ea75
add esp, 0x228
ret
mov eax, dword [esp + 8]
cmp eax, 1
je 0x42c1b2
cmp eax, 3
je 0x42c1b2
lea eax, [esp + 4]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x42c0fc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b544c
jmp 0x42c1d9
mov eax, 0xcccccccd
mul dword [esp + 0x1c]
shr edx, 3
cmp edx, 0x3e8
jae 0x42c117
mov edx, 0x3e8
jmp 0x42c121
mov eax, 0x2710
cmp edx, eax
cmova edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42c15a
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b4d80
jmp 0x42c1d9
mov eax, dword [esp + 8]
cmp eax, 1
je 0x42c18d
cmp eax, 3
je 0x42c18d
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b545c
jmp 0x42c06d
mov edx, 0x4b4894
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b5454
jmp 0x42c06d
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x4b4024
mov ecx, str.STRT
call fcn.00478640
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov edx, 0x4b4de8
lea eax, [esp + 0x20]
mov ecx, str.STRT
push 0x30
push eax
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x228]
pop esi
xor ecx, esp
call fcn.0048ea75
add esp, 0x228
ret