joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ff14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43ff45
je 0x43ff9f
sub eax, 7
je 0x43ff66
dec eax
je 0x43ff90
sub eax, 0x17
je 0x440020
jmp 0x44005e
add eax, 0xffffff00
sub eax, 9
jb 0x44000c
add eax, 0xffffff09
sub eax, 0xb
jb 0x43fff6
jmp 0x44005e
mov eax, ebx
call fcn.00429010
mov edi, eax
test edi, edi
je 0x4400be
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
je 0x4400c7
jmp 0x4400be
test byte [ebx + 0x44], 0x20
jne 0x4400c7
jmp 0x4400be
mov edx, esi
mov eax, ebx
call fcn.0043d800
cmp dword [esi + 0xc], 0xffffffff
jne 0x4400c7
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00407844
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0043c2b0
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043fdc4
test eax, eax
je 0x4400c7
mov dword [esi + 0xc], 1
jmp 0x4400c7
mov edx, esi
mov eax, ebx
call fcn.0043fe88
test al, al
jne 0x4400c7
jmp 0x4400be
mov eax, ebx
call fcn.0043ce78
test al, al
jne 0x4400c7
jmp 0x4400be
mov eax, ebx
call fcn.00442444
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x4400be
cmp dword [0x4759c4], 0
je 0x4400be
mov eax, dword [0x4759c4]
cmp ebx, dword [eax + 0x24]
jne 0x4400be
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4759c4]
call fcn.0043d71c
jmp 0x4400be
mov eax, dword [0x47777c]
cmp byte [eax + 0x20], 0
je 0x4400be
mov eax, dword [0x47777c]
cmp dword [eax + 0x1c], 0
je 0x4400be
mov eax, dword [esi]
mov edx, dword [0x47777c]
cmp eax, dword [edx + 0x1c]
jne 0x4400be
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00428f24
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb9
call fcn.004030f8
jmp 0x4400c7
mov edx, esi
mov eax, ebx
call fcn.0043d800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440558
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x440574
cmp dword [esi + 4], 0
je 0x4405a1
test byte [ebx + 0x45], 1
jne 0x440593
mov eax, ebx
call fcn.0043f5c8
test eax, eax
jne 0x440593
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4406b1
mov edx, esi
mov eax, ebx
call fcn.004401d0
jmp 0x4406b1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4406aa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00442444
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043d71c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00440558
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00442444
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4406b1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e073
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47685a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45e0cb
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x47687b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45e0c1
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45e0cf
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x402e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub byte [ecx - 0x13b26726], bl
inc edx
xlatb
salc

Function at 0x407c7b
Capabilities:
Encode data using xor

Disassembly:
or al, 0
lea esp, [edi]
add al, ah
mov dword [0x79890066], eax
fadd qword [eax]
inc ebp
jp 0x407ccb
add byte [ecx + edi*2 + 0x40], al
add cl, bl
fiadd word [eax]
xchg ecx, eax
jns 0x407cd7
add byte [ecx + edi*2 + 0x49f58a40], bl
inc eax
add byte [ebx + 0x7a], dh
inc eax
add byte [esi], cl
cmp byte [eax], cl
inc esi
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
leave
or byte [eax], cl
retf 0x808
or bh, bl
or cl, ah
or byte [eax], cl
or byte [eax], cl
sbb byte [eax], cl
or byte [eax], cl
or byte [edx + 0x8080808], bh
or byte [eax], cl
or byte [eax], cl
jl 0x407ceb
or byte [eax], cl
sbb eax, 0x8087d86
add cl, byte [eax]
or byte [ebx], al
or byte [eax], cl
or byte [eax], cl
or byte [esi], ah
daa
or byte [eax], cl
add ecx, dword [eax]
or byte [eax], cl
or byte [eax], cl
daa
and al, 8
and al, byte [eax + ecx]
xor cl, byte [eax]
pop eax
or byte [eax], cl
or byte [edi + esi*8 + 8], ch
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or cl, ch
or byte [esi + 0x65], cl
or byte [eax], cl
or byte [0x806564d], al
or byte [eax], cl
pop es
cmp dl, byte [eax - 0x6f6f1770]
adc dl, byte [ebp + 0x56]
push ebp
push esi
in al, dx
sub esp, 0x58
push esi
lea eax, [ebp - 0x58]
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x4f]
push ecx
mov ecx, dword [ebp + 8]
push ecx
push edi
aam 0x51
call fcn.00407ec0
pop esp
dec ebp
cld
mov edx, dword [ebp + 0x14]
sbb dword [esi], 0x18
mov dword [edi - 0x74367a08], esi
repne scasb al, byte es:[edi]
push es
mov byte [edx], 0x24
lea esi, [edx + 0x1a]
lea ecx, [edi - 1]
push ebx
test ecx, ecx
sub byte [edi], cl
cmp byte [ecx + eax], 0x30
jne 0x407d71
dec edi
pop ecx
test ecx, ecx
jg 0x407d65
hlt
stc
jge 0x407d70
mov edi, dword [esi + 0xfdb850c]
invalid

Function at 0x401a2d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401a3c
push esp
mov dword [ebp - 0x24], 0x401778
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401adb
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401abc
pop ebp
ret 0x10
Function at 0x401a5b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401a89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401a89
xor al, al
jmp 0x401b04
call fcn.004011e0
push eax
lea ecx, [ebp + 8]
call fcn.00402965
or dword [ebp - 8], 0xffffffff
lea eax, [ebp + 8]
push 0x104
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.004025e9
push eax
push ebx
push 0x41e89c
push dword [edi]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.004025c3
test edi, edi
je 0x401afa
cmp edi, 0x6f
je 0x401afa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401afa
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
add ecx, 0x1c
call fcn.004024ed
mov bl, 1
lea ecx, [ebp + 8]
call fcn.0040294a
mov al, bl
pop edi
pop ebx
leave
ret 4

Function at 0x401c4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x420018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
mov edi, ecx
or esi, 0xffffffff
call fcn.00405a60
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x41e8b0
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401d49
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402580
lea eax, [ebp - 0x214]
push eax
lea ecx, [edi + 0x10]
call fcn.0040239f
lea ecx, [ebp - 0x214]
call fcn.0040294a
push 0x41e784
push 0x66
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x401d49
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401d49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401d49
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401d49
push esi
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, edi
call fcn.00401fdb
pop ecx
test eax, eax
jne 0x401d3f
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x401d49
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004056fe
leave
ret

Function at 0x402341
Capabilities:
Contain obfuscated stackstrings

Disassembly:
faddp st(6)
inc ebp
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
invalid
push cs
Function at 0x40239f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00401fc2
push eax
push esi
push dword [ebp + 8]
call fcn.00401f77
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00401fb2
cmp bl, 0xff
call ebp
push eax
Function at 0x402625
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402666
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402661
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40264b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402653
cmp edx, ebx
jne 0x4027a1
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402622
add eax, dword [eax + 4]
jmp 0x40260f
mov dword [ebp + 0xc], ebx
jmp 0x402671
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402689
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4026a7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402705
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4026ec
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4026f5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4026ff
add ecx, eax
or byte [ecx], 4
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4026e1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40266b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402752
dec eax
je 0x402749
sub eax, 3
je 0x402740
mov dword [ebp - 4], 0x40
jmp 0x40276f
mov dword [ebp - 4], 4
jmp 0x402755
mov dword [ebp - 4], 0x20
jmp 0x402755
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4027a1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
invalid
invalid
invalid
Function at 0x402c6e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax - 1]
jne 0x402c7b
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x402ca6
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x402e70
cmp dword [ebp + 0xc], 1
je 0x402e70
cmp dword [ebp + 0xc], 8
jne 0x402e38
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
invalid
invalid
Function at 0x401160
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [ebp - 8]
push edi
push eax
push 0x24
lea eax, [ebp - 0x2c]
mov edi, ecx
push eax
push 0
push edi
call ebx
test eax, eax
jne 0x40119d
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004035c5
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
cmp eax, 2
je 0x4011bb
cmp eax, 3
je 0x4011bb
cmp eax, 5
je 0x4011bb
cmp eax, 6
jne 0x4011d3
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call ebx
test eax, eax
jne 0x4011a4
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004035c5
mov esp, ebp
pop ebp
ret

Function at 0x4011f0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416894
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40123a
xor al, al
jmp 0x401305
push 0xc
call fcn.004035db
mov esi, eax
xorps xmm0, xmm0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
mov dword [ebp - 0x14], esi
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0x41cf14
mov dword [esi + 4], edi
mov dword [esi + 8], eax
push 0xf01ff
push ebx
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x401286
xor bl, bl
jmp 0x4012ef
push 0xc
call fcn.004035db
mov edi, eax
xorps xmm0, xmm0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
mov ecx, ebx
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0x41cf14
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
call fcn.00401160
test eax, eax
je 0x4012dc
cmp eax, 4
jne 0x4012c5
mov bl, 1
jmp 0x4012de
cmp eax, 1
jne 0x4012dc
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
setne bl
jmp 0x4012de
xor bl, bl
mov byte [ebp - 4], 8
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov dword [ebp - 4], 9
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004035c5
mov esp, ebp
pop ebp
ret
Function at 0x401330
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4168d4
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x401377
xor al, al
jmp 0x401448
push 0xc
call fcn.004035db
mov esi, eax
xorps xmm0, xmm0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
mov dword [ebp - 0x14], esi
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0x41cf14
mov dword [esi + 4], edi
mov dword [esi + 8], eax
push 0xf01ff
push str.Spooler
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4013c7
xor bl, bl
jmp 0x401432
push 0xc
call fcn.004035db
mov edi, eax
xorps xmm0, xmm0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
mov ecx, ebx
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0x41cf14
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
call fcn.00401160
test eax, eax
je 0x40141f
cmp eax, 1
jne 0x401406
mov bl, al
jmp 0x401421
cmp eax, 4
jne 0x40141f
lea eax, [ebp - 0x38]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
setne bl
jmp 0x401421
xor bl, bl
mov byte [ebp - 4], 8
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov dword [ebp - 4], 9
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 4]
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004035c5
mov esp, ebp
pop ebp
ret
Function at 0x402680
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416a3c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x41f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402250
test al, al
je 0x4026e0
push str.Wondershare_PDFelement_Monitor
push str.__MSG____s_already_exist._n
call fcn.00401130
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004035c5
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
push 0x208
movq qword [ebp - 0x18], xmm0
call fcn.004038a6
mov edi, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], edi
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0x208
movq qword [ebp - 0x20], xmm0
call fcn.004038a6
mov esi, eax
mov dword [ebp - 0x1c], 0
add esp, 8
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
mov ecx, 0x420f64
cmp dword [0x420f78], 8
mov edx, edi
cmovae ecx, dword [0x420f64]
nop
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x402740
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x402779
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push 0x41e418
push eax
call fcn.00405629
cmp word [edi], 0
mov edx, edi
je 0x40278a
add edx, 2
cmp word [edx], 0
jne 0x402781
push ecx
push str.WSMonEditor.dll
mov ecx, edi
call fcn.00402a40
add esp, 8
mov edx, esi
cmp word [esi], 0
je 0x4027ab
add edx, 2
cmp word [edx], 0
jne 0x4027a2
push ecx
push str.WSMonEditor.dll
mov ecx, esi
call fcn.00402a40
add esp, 8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
test eax, eax
jne 0x4027da
push edi
push str.__ERR___Cant_copy__s_to__s._n
call fcn.00401130
add esp, 0xc
jmp 0x402762
call fcn.004035d6
push edi
call fcn.004035d6
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x420f58]
mov dword [ebp - 0x2c], str.Wondershare_PDFelement_Monitor
mov dword [ebp - 0x24], str.WSMonEditor.dll
cmp eax, 9
jne 0x402810
mov dword [ebp - 0x28], str.Windows_x64
jmp 0x402829
test eax, eax
jne 0x40281d
mov dword [ebp - 0x28], str.Windows_NT_x86
jmp 0x402829
cmp eax, 0xc
jne 0x402851
mov dword [ebp - 0x28], str.Windows_ARM64
lea eax, [ebp - 0x2c]
push eax
push 2
push 0
call dword [sym.imp.WINSPOOL.DRV_AddMonitorW]
test eax, eax
jne 0x4026c5
push str.__ERR___Call_AddMonitor_fail._n
call fcn.00401130
add esp, 4
jmp 0x402762
push eax
push str.__ERR___Unknown_processor_model._architecture_value_is__d.
call fcn.00401130
add esp, 8
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x14]
push 0x41e418
jmp 0x402773