joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4614d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x461576
cmp dword [ebx + 0x90], 0
jne 0x461570
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46144c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x461570
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x461536
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461570
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.00419b70
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x461545
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461794
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x46f178]
cmp dword [eax + 0x170], 0
je 0x4618f9
test bl, bl
jne 0x461847
cmp dword [esi + 0x98], 0
jne 0x46183c
mov eax, esi
call fcn.0046404c
push eax
push 0x4616a0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x46180d
mov eax, dword [0x46f178]
cmp byte [eax + 0xcf], 0
je 0x46180d
mov eax, dword [esi + 0xd4]
call fcn.00406390
mov edi, eax
cmp edi, 0
jl 0x46180d
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4617f6
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46183c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00419b70
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46181c
inc dword [esi + 0x98]
jmp 0x4618f9
cmp dword [esi + 0x98], 0
jle 0x4618f9
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x4618f9
cmp dword [esi + 0x40], 0
je 0x4618a4
mov eax, dword [0x46f178]
cmp byte [eax + 0xcf], 0
je 0x4618a4
mov eax, dword [esi + 0xd4]
call fcn.00406390
mov edi, eax
cmp edi, 0
jl 0x4618a4
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46188d
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4618d3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.00419b70
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4618b3
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x4570c8]
call fcn.00406550
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4624b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x46251f
cmp byte [ebx + 0xcf], 0
jne 0x46251f
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405658
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x46250c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46252c
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040551c
jmp 0x46252c
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040551c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x46380c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x46387a
mov eax, esi
call fcn.0044aa50
test al, al
je 0x46387a
mov eax, dword [ebx + 0x80]
call fcn.0044a748
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46387a
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x46386e
push 0
mov eax, dword [ebx + 0x80]
call fcn.0044a748
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00441ec8
jmp 0x46387a
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00463658
pop esi
pop ebx
ret

Function at 0x4645d4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405504
xor eax, eax
push ebp
push 0x4646fd
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x4646b9
push 4
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x464668
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x464640
mov edi, dword [ebp - 0x20]
push esi
call sub.advapi32.dll_CloseServiceHandle
test edi, edi
jne 0x464659
mov eax, dword [ebp - 8]
mov edx, 0x464718
call fcn.0040551c
jmp 0x4646b1
mov eax, dword [ebp - 8]
mov edx, 0x46473c
call fcn.0040551c
jmp 0x4646b1
call sub.kernel32.dll_GetLastError
mov esi, eax
cmp esi, 0x424
jne 0x464686
mov eax, dword [ebp - 8]
mov edx, 0x464718
call fcn.0040551c
jmp 0x4646b1
push 0x464758
push dword [ebp - 4]
push 0x464780
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.0040ab5c
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.00405978
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x4646da
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 0x4647b4
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464704
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405514
lea eax, [ebp - 4]
call fcn.0040550c
ret
Function at 0x464a20
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405504
xor eax, eax
push ebp
push 0x464ba3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x464a8c
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x2c]
mov eax, ebx
mov edx, 0x464bbc
call fcn.004058a8
jmp 0x464b80
xor edx, edx
push ebp
push 0x464b70
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x464b39
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x464af3
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x30]
mov eax, ebx
mov edx, 0x464c10
call fcn.004058a8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x464b0e
mov eax, ebx
mov edx, 0x464c4c
call fcn.0040551c
jmp 0x464b2e
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x34]
mov eax, ebx
mov edx, 0x464c78
call fcn.004058a8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x464b59
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x38]
mov eax, ebx
mov edx, 0x464cc8
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464b77
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464baa
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00405514
lea eax, [ebp - 4]
call fcn.0040550c
ret
Function at 0x464d08
Capabilities:
Modify service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff578
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xa88], ebx
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405504
mov eax, dword [ebp - 8]
call fcn.00405504
xor eax, eax
push ebp
push 0x464f61
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x464f70
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x464da1
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa78]
call fcn.0040ab5c
mov ecx, dword [ebp - 0xa78]
mov eax, esi
mov edx, 0x464f80
call fcn.004058a8
jmp 0x464f36
xor eax, eax
push ebp
push 0x464f26
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
jbe 0x464ee9
lea eax, [ebp - 0x30]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x14]
push eax
push 0x146c
lea eax, [ebp - 0xa74]
push eax
push ebx
call sub.advapi32.dll_QueryServiceConfigW
test eax, eax
je 0x464e99
lea eax, [ebp - 0xc]
lea edx, [ebp - 0xa68]
mov ecx, 0x105
call fcn.004056d4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0040a3a8
test eax, eax
je 0x464e8b
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x85e]
push eax
mov eax, dword [ebp - 8]
call fcn.004055a8
push eax
mov eax, dword [ebp - 0xa6c]
push eax
mov eax, dword [ebp - 0xa70]
push eax
mov eax, dword [ebp - 0xa74]
push eax
push ebx
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
je 0x464e63
mov eax, esi
mov edx, 0x464fd4
call fcn.0040551c
jmp 0x464ee1
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa7c]
call fcn.0040ab5c
mov ecx, dword [ebp - 0xa7c]
mov eax, esi
mov edx, 0x465018
call fcn.004058a8
jmp 0x464ee1
mov eax, esi
mov edx, 0x465070
call fcn.0040551c
jmp 0x464ee1
push 0x4650c0
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa80]
call fcn.0040ab5c
push dword [ebp - 0xa80]
push 0x465118
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa84]
call fcn.0040ab5c
push dword [ebp - 0xa84]
mov eax, esi
mov edx, 4
call fcn.00405978
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x464f0f
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa88]
call fcn.0040ab5c
mov ecx, dword [ebp - 0xa88]
mov eax, esi
mov edx, 0x465128
call fcn.004058a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f2d
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f68
lea eax, [ebp - 0xa88]
mov edx, 5
call fcn.00405514
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405514
ret
Function at 0x465278
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405504
mov eax, dword [ebp - 8]
call fcn.00405504
mov eax, dword [ebp - 0xc]
call fcn.00405504
xor eax, eax
push ebp
push 0x465427
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x465438
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x4652fa
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov edx, 0x465448
call fcn.004058a8
jmp 0x4653ff
cmp byte [ebp + 0xc], 0
je 0x46533f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x46548c
mov eax, dword [ebp - 0xc]
call fcn.004055a8
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004055a8
push eax
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
push ebx
call sub.advapi32.dll_CreateServiceW
mov esi, eax
jmp 0x46537c
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x46548c
mov eax, dword [ebp - 0xc]
call fcn.004055a8
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004055a8
push eax
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
push ebx
call sub.advapi32.dll_CreateServiceW
mov esi, eax
test esi, esi
je 0x46538e
mov eax, edi
mov edx, 0x4654b8
call fcn.0040551c
jmp 0x4653b0
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x1c]
mov eax, edi
mov edx, 0x4654e4
call fcn.004058a8
jmp 0x4653ff
xor eax, eax
mov dword [ebp - 0x10], eax
cmp byte [ebp + 0x10], 0
je 0x4653f9
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x4653d9
mov eax, edi
mov edx, 0x465534
call fcn.0040551c
jmp 0x4653f9
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040ab5c
mov ecx, dword [ebp - 0x20]
mov eax, edi
mov edx, 0x46555c
call fcn.004058a8
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46542e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405514
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405514
ret
Function at 0x46559c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405504
mov eax, dword [ebp - 8]
call fcn.00405504
xor eax, eax
push ebp
push 0x46581d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor edx, edx
push ebp
push 0x4657f8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x4655f6
mov byte [ebp - 0xd], 0
push ebx
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4657e7
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jne 0x465654
call sub.kernel32.dll_GetLastError
cmp eax, 0x41f
je 0x465623
mov byte [ebp - 0xd], 0
push 0x10c
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
test esi, esi
lea eax, [ebp - 0x18]
push eax
push 0x10c
push esi
push ebx
call sub.advapi32.dll_QueryServiceLockStatusW
test eax, eax
jne 0x46564b
mov byte [ebp - 0xd], 0
cmp dword [esi], 0
push esi
call sub.kernel32.dll_LocalFree
push 2
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x465672
mov byte [ebp - 0xd], 0
xor edx, edx
push ebp
push 0x4657c0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
cmp eax, 4
ja case.default.0x465688
jmp dword [eax*4 + 0x46568f]
xor edi, edi
jmp case.default.0x465688
mov edi, 1
jmp case.default.0x465688
mov edi, 2
jmp case.default.0x465688
mov edi, 3
jmp case.default.0x465688
mov edi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0x10
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x4656e5
mov byte [ebp - 0xd], 0
push 0x465830
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
setne al
test al, al
jne 0x465714
call fcn.004046a8
call fcn.004046a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465802
xor edx, edx
push ebp
push 0x4657a2
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x46584c
mov eax, dword [ebp - 0x20]
push eax
call fcn.004079fc
mov ebx, eax
test ebx, ebx
setne al
test al, al
jne 0x465757
call fcn.004046a8
call fcn.004046a8
call fcn.004046a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465802
cmp dword [ebp - 8], 0
je 0x46576a
mov eax, dword [ebp - 8]
call fcn.004055a8
mov dword [ebp - 0x24], eax
jmp 0x46576f
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
mov edx, dword [0x469a34]
mov eax, dword [ebp - 0x1c]
call ebx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46578b
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4657a9
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465824
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405514
ret
Function at 0x465b08
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405504
xor eax, eax
push ebp
push 0x465c0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b2c4
cmp dword [ebp - 8], 0
je 0x465b51
mov eax, dword [ebp - 8]
mov edx, 0x465c28
call fcn.00405b20
jne 0x465b63
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x465c38
call fcn.004058a8
jmp 0x465b7f
mov ebx, 0x65
mov eax, dword [ebp - 8]
call fcn.0040b04c
test al, al
jne 0x465b7f
mov eax, dword [ebp - 8]
call fcn.0040b070
dec ebx
jne 0x465b68
mov eax, dword [ebp - 4]
call fcn.004055a8
push eax
call sub.kernel32.dll_GetFileAttributesW
test al, 1
je 0x465b9b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040b184
mov dl, 1
mov eax, dword [0x4179c8]
call fcn.0041bf34
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x465be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00425b2c
call fcn.004122ac
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465beb
mov eax, dword [ebp - 0xc]
call fcn.00403bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465c15
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405514
ret
Function at 0x465ca4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x465cac
push ecx
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x465ea2
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x465e70
lea edx, [ebp - 4]
mov eax, 0x465ec0
call fcn.00465168
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b288
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403310
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040b288
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, dword [0x469a38]
call fcn.004058a8
mov eax, dword [ebp - 0xc]
call fcn.0040b004
test al, al
je 0x465e7d
mov edx, dword [0x469a38]
mov eax, dword [ebp - 8]
call fcn.0040a4b8
test al, al
jne 0x465d3d
lea ecx, [ebp - 0x18]
mov eax, 0x465ec0
mov edx, dword [ebp - 0xc]
call fcn.00464d08
lea edx, [ebp - 0x1c]
mov eax, 0x465ec0
call fcn.004645d4
mov eax, dword [ebp - 0x1c]
mov edx, 0x465ee0
call fcn.00405b20
jne 0x465dc3
xor eax, eax
push ebp
push 0x465d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, 0x465ec0
call fcn.00464804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465d88
xor eax, eax
push ebp
push 0x465db4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x465ec0
xor ecx, ecx
mov edx, 2
call fcn.0046559c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465e7d
push 1
push 1
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.00403310
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040b288
lea eax, [ebp - 0x28]
mov edx, dword [0x469a38]
call fcn.00405828
mov ecx, dword [ebp - 0x28]
mov eax, 0x465ec0
mov edx, 0x465efc
call fcn.00465278
xor eax, eax
push ebp
push 0x465e64
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, 0x465efc
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0x11
mov eax, 0x465f20
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0x11
lea edx, [ebp - 0x40]
mov ecx, 1
mov eax, 0x465f58
call fcn.0040b948
mov eax, dword [ebp - 0x30]
call fcn.004055a8
push eax
push 0x465f90
push 0x465fa0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465e7d
lea edx, [ebp - 0x44]
mov eax, 0x465ec0
call fcn.00464a20
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465ea9
lea eax, [ebp - 0x44]
call fcn.0040550c
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00405514
ret
Function at 0x42c368
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
push esi
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 8]
call fcn.0042c23f
lea eax, [ebp - 0x584]
push eax
push dword [ebp + 0xc]
call fcn.0042c23f
lea eax, [ebp - 0x234]
push eax
call fcn.0042c8de
add esp, 0x14
test al, al
mov esi, 0x45f9e4
je 0x42c3b7
lea eax, [ebp - 0x234]
push esi
push eax
call fcn.00457a90
pop ecx
pop ecx
lea eax, [ebp - 0x584]
push eax
call fcn.0042c8de
test al, al
pop ecx
je 0x42c3d7
lea eax, [ebp - 0x584]
push esi
push eax
call fcn.00457a90
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42c3fa
xor eax, eax
jmp 0x42c57f
push ebx
push edi
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00441cb7
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x794]
push eax
push str._s_s
lea eax, [ebp - 0x12c]
push 0x105
push eax
call fcn.0040a6d3
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, 0x104
add esp, 0x28
sub esi, eax
and dword [ebp - 4], 0
lea ebx, [ebp + eax - 0x12c]
call edi
sub eax, dword [0x4681ac]
mov ecx, dword [0x465108]
cmp eax, dword [ecx + 0xb0]
jbe 0x42c49f
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42c498
push 1
push 0xffffffffffffffff
call fcn.0040de6e
pop ecx
pop ecx
call edi
mov dword [0x4681ac], eax
test byte [ebp - 0x47c], 0x10
jne 0x42c559
lea eax, [ebp - 0x450]
push eax
call fcn.00457cb0
cmp eax, esi
pop ecx
ja 0x42c556
lea eax, [ebp - 0x450]
push eax
push ebx
call fcn.00457a80
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0042c65e
add esp, 0x14
cmp byte [ebp + 0x14], 0
je 0x42c535
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x42c559
cmp byte [ebp + 0x10], al
je 0x42c556
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x42c556
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
jmp 0x42c552
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x42c559
inc dword [ebp - 4]
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42c463
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret