joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4445b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
je 0x444600
lea eax, [esi + esi + 2]
push eax
call fcn.00441a20
add esp, 4
lea ecx, [esi + 1]
push ecx
mov edi, eax
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, eax
cmp ebx, esi
je 0x444620
push edi
call fcn.00441a60
add esp, 4
test ebx, ebx
je 0x444600
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jne 0x4445c5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44460e
mov dword [eax], 0
push 0x493d7a
call fcn.0044dba0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push edi
push 0
push 0
call fcn.00474a40
mov ebx, eax
lea edx, [ebx + 1]
push edx
call fcn.00441a20
push esi
push edi
mov ebp, eax
push ebx
push ebp
call fcn.00474a40
mov eax, dword [esp + 0x3c]
add esp, 0x24
test eax, eax
mov byte [ebx + ebp], 0
je 0x444652
mov dword [eax], ebx
push edi
call fcn.00441a60
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x444720
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 4], 0
mov dword [esp], 0
je 0x444744
push eax
lea ecx, [esp + 4]
call fcn.00476850
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea ecx, [esp]
je 0x444779
call fcn.00476730
xor eax, eax
add esp, 8
ret
call fcn.00476730
mov eax, 1
add esp, 8
ret
Function at 0x444790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
je 0x4447bb
push eax
lea ecx, [esp + 0x1c]
call fcn.00476850
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x28]
push eax
push ebp
push ebp
push ebp
push ecx
push esi
mov dword [esp + 0x40], ebp
call edi
mov ebx, eax
cmp ebx, ebp
je 0x4447fb
lea ecx, [esp + 0x18]
call fcn.00476730
lea ecx, [esp + 0x10]
call fcn.00476730
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x28]
add edx, 1
shr edx, 1
push edx
lea ecx, [esp + 0x14]
call fcn.00476740
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
push eax
push ebp
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x28]
push ebp
push ecx
push esi
call edi
mov esi, eax
cmp esi, ebp
je 0x44484f
lea ecx, [esp + 0x18]
call fcn.00476730
lea ecx, [esp + 0x10]
call fcn.00476730
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov word [edx + eax*2 - 2], bp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
push ecx
push edx
push eax
call fcn.00474a40
add esp, 0x10
lea ecx, [esp + 0x18]
call fcn.00476730
lea ecx, [esp + 0x10]
call fcn.00476730
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x4448a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x24]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x24]
cmp edi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
je 0x444910
mov al, byte [edi]
cmp al, bl
mov ecx, edi
je 0x4448de
lea esp, [esp]
cmp al, 0x80
jae 0x444953
mov al, byte [ecx + 1]
add ecx, 1
cmp al, bl
jne 0x4448d0
push esi
call fcn.00441ba0
add esp, 4
test eax, eax
je 0x444953
cmp byte [esi], bl
mov eax, esi
je 0x4448f8
add eax, 1
cmp byte [eax], bl
jne 0x4448f1
sub eax, esi
add eax, 1
push eax
mov eax, dword [esp + 0x24]
push esi
push 1
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x44498b
mov dl, byte [esi]
cmp dl, bl
mov ecx, esi
je 0x44492e
mov al, dl
lea ebx, [ebx]
cmp al, 0x80
jae 0x444953
mov al, byte [ecx + 1]
add ecx, 1
cmp al, bl
jne 0x444920
cmp dl, bl
mov eax, esi
je 0x44493b
add eax, 1
cmp byte [eax], bl
jne 0x444934
mov ecx, dword [esp + 0x20]
sub eax, esi
add eax, 1
push eax
push esi
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x44498b
push esi
lea ecx, [esp + 0x10]
call fcn.00476850
cmp edi, ebx
je 0x44496b
push edi
lea ecx, [esp + 0x18]
call fcn.00476850
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea eax, [edx + edx]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push ecx
push 1
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00476730
lea ecx, [esp + 0xc]
call fcn.00476730
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4449b0
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 8]
call fcn.00476850
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [esp + 4]
mov esi, eax
call fcn.00476730
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x444aa0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp byte [esi], bl
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov eax, esi
je 0x444ace
add eax, 1
cmp byte [eax], bl
jne 0x444ac7
sub eax, esi
lea ecx, [esp + 0x10]
je 0x444c22
push esi
call fcn.004768f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x444af8
test al, 0x10
jne 0x444c1e
push 0x20000
lea ecx, [esp + 0x1c]
call fcn.004762c0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push esi
push ecx
push edx
call fcn.00431500
mov esi, dword [esp + 0x28]
add esp, 0xc
cmp byte [esi], bl
mov edi, esi
je 0x444b7f
cmp byte [esi], 0x5c
jne 0x444b73
mov bl, byte [esi + 1]
add esi, 1
push edi
lea ecx, [esp + 0x14]
mov byte [esi], 0
call fcn.004768f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x444b4f
test al, 0x10
jne 0x444b6d
mov ecx, dword [esp + 0x14]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x444b6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x444bdf
mov byte [esi], bl
xor ebx, ebx
jmp 0x444b76
add esi, 1
cmp byte [esi], 0
jne 0x444b23
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edx
push esi
call fcn.00441b20
add esp, 8
push edi
lea ecx, [esp + 0x14]
call fcn.004768f0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x444bab
test al, 0x10
jne 0x444c1e
mov ecx, dword [esp + 0x14]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x444c1e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x444c1e
call esi
push eax
push edi
push str.CreateDirectory___s__NULL_:_GetLastError__:__d._n
push str.mu_make_sure_path_exists
push 0xbf7
jmp 0x444bf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateDirectory___s__NULL_:_GetLastError__:__d._n
push str.mu_make_sure_path_exists
push 0xbd9
push str.._srcmu.cpp
call fcn.00430960
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.00476730
lea ecx, [esp + 0x18]
call fcn.00476730
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.00476730
lea ecx, [esp + 0x18]
call fcn.00476730
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4451a0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4451ba
mov eax, esi
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push eax
push 0x445130
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 8]
push ecx
push str.best_window__08x_n
call fcn.00430350
mov eax, dword [esp + 0x10]
add esp, 8
pop esi
add esp, 8
ret
Function at 0x446540
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
jle 0x446573
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x18]
lea ebx, [ebx]
push 0
push esi
push edi
push ebx
call ebp
test eax, eax
jle 0x44657d
sub esi, eax
add edi, eax
test esi, esi
jg 0x446560
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x446590
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push edi
mov edi, dword [esp + 0x18]
push 2
add eax, 0xffffffff
push eax
push edi
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x4465bc
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
test eax, eax
push esi
je 0x4465f4
lea ecx, [eax + edi]
cmp edi, ecx
mov esi, edi
jae 0x4465f4
lea ebx, [ebx]
lea eax, [esi + 1]
cmp eax, ecx
jae 0x4465e5
cmp byte [esi], 0xd
jne 0x4465e5
cmp byte [eax], 0xa
je 0x44667c
cmp byte [esi], 0xa
je 0x4466a1
mov esi, eax
cmp esi, ecx
jb 0x4465d0
mov eax, dword [esp + 0x20]
push 0
push 1
lea edx, [esp + 0x1b]
push edx
lea ecx, [edi + eax - 1]
push ebx
mov esi, edi
mov dword [esp + 0x30], ecx
call ebp
cmp eax, 0xffffffff
je 0x446674
test eax, eax
je 0x4466c6
mov al, byte [esp + 0x13]
cmp al, 0xd
jne 0x446654
push 0
push 1
lea eax, [esp + 0x1b]
push eax
push ebx
call ebp
cmp eax, 0xffffffff
je 0x446674
test eax, eax
je 0x4466c6
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x4466ca
cmp esi, dword [esp + 0x20]
jae 0x446654
mov byte [esi], 0xd
add esi, 1
cmp al, 0xa
je 0x4466ca
cmp esi, dword [esp + 0x20]
jae 0x446663
mov byte [esi], al
add esi, 1
push 0
push 1
lea ecx, [esp + 0x1b]
push ecx
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x446613
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, esi
sub ecx, edi
push 0
lea eax, [ecx + 2]
push eax
push edi
push ebx
mov dword [esp + 0x30], eax
call ebp
cmp eax, 0xffffffff
je 0x446674
cmp eax, dword [esp + 0x20]
je 0x4466ca
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, esi
sub edx, edi
push 0
lea eax, [edx + 1]
push eax
push edi
push ebx
mov dword [esp + 0x30], eax
call ebp
cmp eax, 0xffffffff
je 0x446674
cmp eax, dword [esp + 0x20]
je 0x4466ca
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp esi, edi
je 0x446674
mov byte [esi], 0
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4466e0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
mov edi, dword [esp + 0x19c]
cmp edi, 1
jge 0x4466fd
xor eax, eax
pop edi
add esp, 0x190
ret
push esi
mov esi, dword [esp + 0x19c]
lea eax, [esp + 8]
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x446731
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp edi, 0xffffffff
jne 0x44673c
pop esi
xor eax, eax
pop edi
add esp, 0x190
ret
cmp byte [esi], 0
mov eax, esi
je 0x44674b
add eax, 1
cmp byte [eax], 0
jne 0x446743
sub eax, esi
pop esi
pop edi
add esp, 0x190
ret

Function at 0x446c80
Capabilities:
Delete registry key

Disassembly:
sub esp, 8
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 8]
call fcn.00476850
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp + 4]
mov esi, eax
call fcn.00476730
mov eax, esi
pop esi
add esp, 8
ret
jmp 0x4449f0

Function at 0x447ce0
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x492448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x447d5f
push ebp
push esi
push 0x49bd2c
lea ecx, [esp + 0x14]
call fcn.00476850
mov eax, dword [esp + 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x447d5a
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x447d57
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
push str.create_service__d_n
call fcn.00430350
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.00476730
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x447da0
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0xffffffffffffffff
push 0x492108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
push 2
push ebx
push ebx
mov byte [esp + 0x38], 2
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x447ea9
push ebp
push 0x8000
lea ecx, [esp + 0x14]
call fcn.004762c0
mov eax, dword [esp + 0x14]
mov byte [eax], 0x22
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add ecx, 0xffffffff
push ecx
add edx, 1
push edx
push ebx
call fcn.004441a0
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0xc
test eax, eax
jle 0x447ea5
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0x49c414
push eax
push ecx
call fcn.00438fc0
mov edx, dword [esp + 0x1c]
push str._svc
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.00431580
mov ecx, dword [esp + 0x30]
add esp, 0x1c
push ecx
lea ecx, [esp + 0x24]
call fcn.00476850
push 0x49bd2c
lea ecx, [esp + 0x1c]
call fcn.00476850
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
push ebx
push 2
push 0x110
push 0xf01ff
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
je 0x447ea5
push eax
mov esi, 1
call ebp
push edi
call ebp
pop ebp
push esi
push str.create_service__d_n
call fcn.00430350
add esp, 8
cmp esi, ebx
je 0x447ecb
xor esi, esi
call fcn.00447ce0
test eax, eax
je 0x447ecb
mov esi, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
call fcn.00476730
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.00476730
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00476730
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x447f10
Capabilities:
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x491f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
push 1
push ebx
push ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x447f9e
push ebp
push esi
push 0x49bd2c
lea ecx, [esp + 0x14]
call fcn.00476850
mov eax, dword [esp + 0x14]
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x447f99
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x447f91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
jne 0x447f96
mov ebx, 1
push esi
call ebp
push edi
call ebp
pop esi
pop ebp
push ebx
push str.stop_service__d_n
call fcn.00430350
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0xffffffff
call fcn.00476730
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x447fd0
Capabilities:
Delete service

Disassembly:
push 0xffffffffffffffff
push 0x492448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call fcn.00447f10
test eax, eax
je 0x448058
push edi
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
je 0x448057
push esi
push 0x49bd2c
lea ecx, [esp + 0x14]
call fcn.00476850
mov eax, dword [esp + 0x14]
push 0x10004
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x448053
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x448050
mov ebp, 1
push esi
call ebx
push edi
call ebx
pop esi
pop edi
push ebp
push str.delete_service__d_n
call fcn.00430350
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.00476730
mov ecx, dword [esp + 0x10]
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44a6c0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test al, al
jns 0x44a6d7
mov edi, 4
push 0x11
call esi
test al, al
jns 0x44a6e2
or edi, 1
push 0x12
call esi
test al, al
jns 0x44a6ed
or edi, 2
push 0x5b
call esi
test al, al
jns 0x44a6f8
or edi, 8
push 0x5c
call esi
test al, al
jns 0x44a703
or edi, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x44eda0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi], 0
je 0x44edda
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x44ee56
push 0
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0x18], eax
je 0x44ee4c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x44ed60
push 0
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
push 0
mov dword [esi + 0x1c], 0
call fcn.004840b5
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x44ee56
mov edx, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x18]
push eax
call edi
pop edi
pop esi
ret
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret
Function at 0x44f310
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
cmp eax, 0x203
jg 0x44f3e6
je 0x44f3b5
cmp eax, 0x7b
je 0x44f3f1
cmp eax, 0x202
jne 0x44f556
cmp dword [0x4aa6c0], 0
jne 0x44f38c
cmp dword [0x4a95c8], 0
je 0x44f3a5
cmp byte [0x4aa468], 0
jne 0x44f3a0
lea eax, [esp + 0xc]
push eax
push 0x44f2a0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x44f3a0
call fcn.004520f0
mov dword [0x4a95c8], 0
xor eax, eax
add esp, 8
ret
cmp dword [0x4a95c8], 0
je 0x44f34e
cmp byte [0x4aa468], 0
jne 0x44f3a5
jmp 0x44f357
call fcn.0044f260
mov dword [0x4a95c8], 0
xor eax, eax
add esp, 8
ret
cmp dword [0x4aa6c0], 0
je 0x44f3d6
push 0
push str.EVERYTHING
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x44f3d6
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4a95c8], 1
xor eax, eax
add esp, 8
ret
cmp eax, 0x205
jne 0x44f556
push esi
push edi
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.USER32.dll_CreateMenu]
call esi
mov edi, eax
call esi
mov edx, dword [0x4aa7bc]
mov esi, eax
mov eax, dword [edx + 0x1cc]
push eax
push 0x9c41
push 0
push esi
call fcn.00445a30
push 0
push 0
push 0x800
push esi
call fcn.00445a30
mov ecx, dword [0x4aa7bc]
mov eax, dword [0x4a941c]
mov edx, dword [ecx + 0x1d0]
neg eax
push edx
sbb eax, eax
push 0x9c42
and eax, 8
push eax
push esi
call fcn.00445a30
mov ecx, dword [0x4aa7bc]
mov eax, dword [0x4a9338]
mov edx, dword [ecx + 0x1d4]
neg eax
push edx
sbb eax, eax
push 0x9c43
and eax, 8
push eax
push esi
call fcn.00445a30
mov ecx, dword [0x4aa7bc]
mov edx, dword [ecx + 0x1d8]
add esp, 0x40
push edx
push 0x9c44
push 0
push esi
call fcn.00445a30
push 0
push 0
push 0x800
push esi
call fcn.00445a30
mov eax, dword [0x4aa7bc]
mov ecx, dword [eax + 0x1dc]
push ecx
push 0x9c45
push 0
push esi
call fcn.00445a30
push 0
push 0
push 0x800
push esi
call fcn.00445a30
mov edx, dword [0x4aa7bc]
mov eax, dword [edx + 0x1e0]
add esp, 0x40
push eax
push 0x9c46
push 0
push esi
call fcn.00445a30
push 0x493d7a
push esi
push 0x10
push edi
call fcn.00445a30
add esp, 0x20
push 0
push 0x9c41
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov ecx, dword [0x4a95c4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x4a95c4]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 0
push edx
push 0
push eax
push ecx
push 0x22
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [0x4a95c4]
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
xor eax, eax
add esp, 8
ret