joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ad60
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45af0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45aeec
mov dl, 1
mov eax, dword [0x41b9c0]
call fcn.00403d20
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404d30
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45aedb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044fc70
test al, al
je 0x45aece
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45af1c
lea eax, [ebp - 0x254]
call fcn.0040aa5c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45aece
xor eax, eax
push ebp
push 0x45aec7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45af54
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45aeb0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404fa0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45aeb0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aece
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45add1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00420748
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af12
lea eax, [ebp - 0x260]
call fcn.00404d30
ret

Function at 0x45b884
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4f6c90]
cmp byte [eax + 0xad], 0
jne 0x45b8f5
cmp dword [0x4f6cac], 0
jne 0x45b8b6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45b840
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4f6cac], eax
cmp dword [0x4f6ca8], 0
jne 0x45b8d1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4f6ca8], eax
cmp dword [0x4f6cb0], 0
jne 0x45b8f5
push esp
push 0
push 0
push 0x45b7e4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4f6cb0], eax
pop edx
ret
Function at 0x45bac8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45badf
add esp, 0xfffffff0
call fcn.00404074
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004250c8
mov eax, dword [0x4f1b18]
cmp word [eax + 2], 0
jne 0x45bb07
mov eax, dword [0x4f1b18]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d5a4
mov eax, dword [0x4f1c54]
cmp word [eax + 2], 0
jne 0x45bb21
mov eax, dword [0x4f1c54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d7b0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42872c]
call fcn.0042fd50
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45bcd8
mov eax, dword [0x4f1994]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00430124
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45de84
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f1994]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ede8
test eax, eax
je 0x45bc28
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a04c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ee1c
test eax, eax
je 0x45bc3c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404fa0
mov byte [ebx + 0xd4], 0
push ebx
push 0x45d1f0
call fcn.00426864
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4f1780]
cmp byte [eax], 0
jne 0x45bc8d
mov eax, ebx
call fcn.0045be1c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045e05c
mov eax, ebx
call fcn.0045ebc0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45bccd
call fcn.004040cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c09c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45c13b
cmp dword [ebx + 0x94], 0
jne 0x45c135
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c024
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c135
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c0fb
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c135
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041dbd4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c10a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45c354
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4f6c90]
cmp dword [eax + 0x30], 0
je 0x45c4b1
test bl, bl
jne 0x45c402
cmp dword [esi + 0x9c], 0
jne 0x45c3f7
mov eax, esi
call fcn.0045ea3c
push eax
push 0x45c280
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45c3c8
mov eax, dword [0x4f6c90]
call fcn.0045f11c
test al, al
je 0x45c3c8
mov eax, dword [0x4f6cb4]
call fcn.00406134
mov edi, eax
cmp edi, 0
jl 0x45c3c8
push 0
mov eax, dword [0x4f6cb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45c3b2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45c3f7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041dbd4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45c3d7
inc dword [esi + 0x9c]
jmp 0x45c4b1
cmp dword [esi + 0x9c], 0
jle 0x45c4b1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45c4b1
cmp dword [esi + 0x44], 0
je 0x45c45d
mov eax, dword [0x4f6c90]
call fcn.0045f11c
test al, al
je 0x45c45d
mov eax, dword [0x4f6cb4]
call fcn.00406134
mov edi, eax
cmp edi, 0
jl 0x45c45d
push 5
mov eax, dword [0x4f6cb4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45c447
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45c48c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0041dbd4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45c46c
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4f6cb4
mov ecx, 1
mov edx, dword [0x45c260]
call fcn.004062e8
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45cf44
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45cfae
mov eax, ebx
call fcn.0045f11c
test al, al
jne 0x45cfae
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404e20
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45cf9b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45cfbb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d84
jmp 0x45cfbb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d84
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45e240
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e2ae
mov eax, esi
call fcn.0044a9e8
test al, al
je 0x45e2ae
mov eax, dword [ebx + 0x84]
call fcn.0044a664
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e2ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45e2a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044a664
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004425f8
jmp 0x45e2ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045e07c
pop esi
pop ebx
ret

Function at 0x464648
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004051b0
xor eax, eax
push ebp
push 0x46477d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x464750
xor edx, edx
push ebp
push 0x464749
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x464695
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46471e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x46470d
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4646d4
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004051c0
lea ecx, [ebx + 1]
mov edx, esi
call fcn.0040314c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464714
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4f1808]
mov dl, 1
mov eax, dword [0x408300]
call fcn.0040df50
call fcn.00404688
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464784
lea eax, [ebp - 4]
call fcn.00404d30
ret
Function at 0x46478c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464947
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004054b4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x464960
call fcn.00405048
mov eax, ebx
call fcn.00425708
mov edi, eax
dec edi
test edi, edi
jl 0x464844
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004256dc
mov edx, dword [0x462760]
call fcn.00403edc
test al, al
je 0x464840
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004256dc
lea edx, [ebp - 0x14]
call fcn.004426d8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004054b4
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004050c4
inc esi
dec edi
jne 0x4647f2
movzx eax, byte [0x464964]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x464970
mov eax, dword [ebp - 8]
call fcn.0040f2f4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404dc8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004426d8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x464960
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.004426d8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x464960
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x464960
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x46497c
call fcn.0040aadc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46494e
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404d54
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404d54
lea eax, [ebp - 0x14]
call fcn.00404d30
lea eax, [ebp - 0x10]
call fcn.00404d30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d54
ret

Function at 0x4663fc
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004051b0
xor eax, eax
push ebp
push 0x46647a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004051c0
mov dword [ebp - 8], eax
clc
Function at 0x46751c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4676c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004033a8
cmp word [ebx + 0xa2], 0
je 0x467565
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x467579
lea esi, [ebp - 0xc]
jmp 0x46757b
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x467588
xor edi, edi
jmp 0x467595
mov eax, dword [ebx + 0x80]
call fcn.004051c0
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.004051c0
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00466bcc
mov eax, dword [ebp - 0x14]
call fcn.004051c0
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.004051c0
push eax
mov eax, dword [ebp - 4]
call fcn.004051c0
push eax
mov eax, ebx
call fcn.00466d0c
push eax
mov eax, ebx
call fcn.00466ce0
push eax
mov eax, ebx
call fcn.00466c98
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00466a98
mov eax, dword [ebp - 0x18]
call fcn.004051c0
push eax
mov eax, dword [ebx + 8]
call fcn.004051c0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x46761e
call fcn.0040f7bc
xor edx, edx
push ebp
push 0x467697
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x46765c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x467652
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46769e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4676d0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4676fc
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004051c0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x467721
call fcn.0040f7bc
xor eax, eax
push ebp
push 0x467758
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x467741
call fcn.0040f7bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46775f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4a42c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4a42e5
add esp, 0xfffffff0
call fcn.00404074
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4a4483
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0049aa1c
test al, al
jne 0x4a4322
mov ecx, 0x4a44b4
mov dl, 1
mov eax, dword [0x48f0d4]
call fcn.0040de94
call fcn.00404688
xor eax, eax
push ebp
push 0x4a434e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.004994c8
lea edx, [ebp - 8]
mov eax, esi
call fcn.004993b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a436e
mov eax, dword [ebp - 8]
mov edx, 0x4a44f0
call fcn.004057ec
je 0x4a438b
mov eax, esi
mov edx, 0x4a44f0
call fcn.004057ec
jne 0x4a43af
mov eax, edi
mov edx, 0x4a4500
call fcn.004057ec
je 0x4a43af
mov ecx, 0x4a44d8
mov dl, 1
mov eax, dword [0x48f37c]
call fcn.0040de94
call fcn.00404688
mov eax, edi
xor edx, edx
call fcn.004057ec
jne 0x4a43dc
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057ec
je 0x4a43dc
mov ecx, 0x4a44d8
mov dl, 1
mov eax, dword [0x48f37c]
call fcn.0040de94
call fcn.00404688
mov eax, dword [ebp - 8]
mov edx, 0x4a4540
call fcn.004057ec
jne 0x4a440f
mov eax, edi
mov edx, 0x4a454c
call fcn.004057ec
je 0x4a440f
mov ecx, 0x4a44d8
mov dl, 1
mov eax, dword [0x48f37c]
call fcn.0040de94
call fcn.00404688
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, ebx
call fcn.004a2398
lea eax, [ebx + 4]
mov edx, esi
call fcn.0040554c
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.0040554c
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 8]
call fcn.0040554c
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 4]
call fcn.0040554c
lea eax, [ebx + 8]
call fcn.00405510
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
movzx eax, byte [ebp + 8]
mov byte [ebx + 0x34], al
movzx eax, word [0x4a4598]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a448a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405528
ret
Function at 0x4a5d8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4a5da9
add esp, 0xfffffff0
call fcn.00404074
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a5f46
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0049aa1c
test al, al
jne 0x4a5de6
mov ecx, 0x4a5f78
mov dl, 1
mov eax, dword [0x48f0d4]
call fcn.0040de94
call fcn.00404688
xor eax, eax
push ebp
push 0x4a5e12
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.004994c8
lea edx, [ebp - 8]
mov eax, esi
call fcn.004993b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5e32
mov eax, edi
xor edx, edx
call fcn.004057ec
jne 0x4a5e5f
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004057ec
je 0x4a5e5f
mov ecx, 0x4a5f9c
mov dl, 1
mov eax, dword [0x48f37c]
call fcn.0040de94
call fcn.00404688
mov eax, dword [ebp - 8]
mov edx, 0x4a5fb4
call fcn.004057ec
jne 0x4a5e92
mov eax, edi
mov edx, 0x4a5fc0
call fcn.004057ec
je 0x4a5e92
mov ecx, 0x4a5f9c
mov dl, 1
mov eax, dword [0x48f37c]
call fcn.0040de94
call fcn.00404688
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, ebx
call fcn.004a2398
lea eax, [ebx + 4]
mov edx, esi
call fcn.0040554c
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.0040554c
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 8]
call fcn.0040554c
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 4]
call fcn.0040554c
lea eax, [ebx + 8]
call fcn.00405510
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41b264]
call fcn.00403d20
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
movzx eax, word [0x4a600c]
push eax
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4920f8]
call fcn.004a15ec
mov dword [ebx + 0x3c], eax
movzx eax, word [0x4a6010]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5f4d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405528
ret