joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009aaa
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x1009b10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1009b34
test esi, esi
je 0x1009b24
lea eax, [ebp - 0x84]
push eax
call fcn.010098c9
mov eax, dword [eax]
mov dword [esi], eax
test edi, edi
je 0x1009b32
mov ax, word [ebp - 0x82]
mov word [edi], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100736d
leave
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7c044f2e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x44f7621c
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x4010a8
mov eax, esi
pop esi
ret

Function at 0x401258
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x72e
cmp dword [ebp - 0x18], 0x21a8
jle 0x4012c7
invalid
mov dword [ebp - 0xc], 0x1f
jmp 0x4012d7
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40145c
mov dword [ebp - 0x1c], 0xf84
cmp dword [ebp - 0x1c], 0x19f2
jle 0x401386
pop ecx
salc
or byte [eax], 0x9c
push ebx
shr dword [esi], 0xb5
sub al, 0x67
push esp
pop ecx
cdq
sahf
pop ebx
hlt
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x401399
mov byte [ebp - 1], 1
jmp 0x40139d
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x4013b6
mov byte [ebp - 2], 1
jmp 0x4013ba
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
mov dword [ebp - 0x20], 0x10d5
cmp dword [ebp - 0x20], 0x1ac9
jle 0x401420
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x401432
and dword [ebp - 0x14], 0
jmp 0x40143f
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4012d0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x418be7
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x418cf6
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x418cba
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x418c9a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x418c7b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x418c98
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0042e2ef
mov dword [eax], 1
jmp 0x418c70
jmp 0x418cb8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x418cb8
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x418cf4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
push 0x69c0
push 1
push 0x2660
push 0xe41
push dword [ebp - 0x44]
push 0
push 0x1ad8
push 0x622
push 0x3462
push 0x6a26
call fcn.0041dbe4
add esp, 0x2c
jmp 0x418d21
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], eax
push 0x3667
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
push eax
push 0x2a0c
push 1
push 0x6e2a
push 0x4873
call fcn.0040c177
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x41af23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41aff9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41af86
push 0x28d1
push 1
push 0x5601
push 0x5137
push 0x5aca
push 0x66fc
push 0x1629
push 0x2055
call fcn.0041b005
add esp, 0x20
jmp 0x41aff7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41afac
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x41aff7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41afda
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x41aff7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0042e2ef
mov dword [eax], 0xfdf99ff6
jmp 0x41afcf
jmp 0x41b001
push 1
call fcn.004131be
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41b9b5
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41b9e4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
call fcn.0041bb27
add esp, 0xc
jmp 0x41bb23
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41ba5f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41ba41
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x41ba5a
push 1
push 0x1c88
push 0x1f53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x41bb23
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41bae8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xfffffff1
jmp 0x41ba9d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe3
je 0x41bae6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41bae4
push 0x5275
push 0
push 1
push 0xaf4
push 0x3559
push 0x52f
push 0x24e3
push 0x13c5
push 0x5194
push 0
push 1
call fcn.0040c328
add esp, 0x2c
jmp 0x41ba92
jmp 0x41bb23
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x41bb23
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12d7
push 0xa96
push 0x1511
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x421f96
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x422040
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x422007
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x421fee
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x422005
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42203e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x54d1
push 1
push 0x3399
push 0
push 0x5172
push 0x1d08
push 0x193
push 1
push 0
push 0xf17
call fcn.0042443e
add esp, 0x2c
jmp 0x422061
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x28]
push 0x645a
push dword [ebp - 0x2c]
call fcn.004093e8
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4349a9
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x434a83
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x434a79
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x434a2c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x434a2a
push 0xb65
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x434a77
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x434a5a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x434a77
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.0042e2ef
mov dword [eax], 0x911b9c6f
jmp 0x434a4f
jmp 0x434a81
push 0
call fcn.00435a78
pop ecx
jmp 0x434a9d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push 0
push dword [ebp - 0x40]
push 1
push 0x19f8
call fcn.0044739c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44002a
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x440175
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x440110
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4400e0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4400de
push 0x1458
push 1
push 1
push 0x40b9
push 0x4939
push 0x6fed
push 0x2a6f
push 0x4c6f
push 0
call fcn.00442bdb
add esp, 0x24
jmp 0x44010e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
push dword [eax + 0x18]
push 0
call fcn.0042fa5d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x440173
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x440153
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jge 0x440151
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x440138
jmp 0x440173
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x440173
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x44019d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
push 0x2a4d
push 0
push 0x5c82
push dword [ebp - 0x68]
push 1
push dword [ebp - 0x6c]
call fcn.0043554b
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x445fc7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x446009
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 0x39c5
push dword [ebp - 8]
push 0x2b0e
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004460ad
add esp, 0x18
jmp 0x4460a9
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x446094
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x446057
push 0x17c1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x446092
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x1d
jmp 0x446079
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x14
jg 0x446092
mov dword [ebp - 0x2c], 0xfff8
cmp dword [ebp - 0x2c], 0
je 0x446090
jmp 0x446092
jmp 0x44606e
jmp 0x4460a9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 1
push 0
call fcn.00432387
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x44e6f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x44e7cf
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44e77c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
push 0x4543
push dword [ebp - 0x30]
call fcn.0044e84d
add esp, 0x1c
jmp 0x44e7cd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x44e7a8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44e7a6
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x44e7cd
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x44e7cd
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x44e849
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x44e809
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 1
call fcn.00436b7c
add esp, 0xc
jmp 0x44e849
push 0
push 0x4c4f
push 0x56b
push 0x4f01
push 0x7b2d
push 0x15d2
push 0x5ad6
push 0xf9c
push 0
push 0x2ab8
push 1
push 0x2cb9
push 0x30dd
call fcn.00445c39
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x45243d
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4524f6
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x452494
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x7cab
push 1
call fcn.00452553
add esp, 0x10
jmp 0x4524f4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4524b0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x4524f4
mov byte [ebp - 1], 0
push 1
push 0x3f1a
push 0x2d43
push 0x50c3
push 0x2958
push 1
push 0x774b
push 0x2a9d
push 0
lea eax, [ebp - 1]
push eax
push 0
push 0x5334
push 1
push 0x7e4d
push 1
call fcn.00449467
add esp, 0x3c
jmp 0x45254f
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x452522
push 1
push 0x41f3
call fcn.0044c693
pop ecx
pop ecx
jmp 0x45254f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 1
push 0x74a
push dword [ebp - 0x34]
push 0x3f4b
push 1
push 0x2fb9
call fcn.00449729
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4812bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret