joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5d04
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, 0x5ca310
mov eax, dword [0x5cf9e4]
cmp dword [eax], 2
jne 0x4b5eb0
push 0x4b5ec8
call fcn.00407834
mov dword [ebx], eax
cmp dword [ebx], 0
sete byte [0x5d5184]
cmp dword [ebx], 0
jne 0x4b5d3f
push 0x4b5ec8
call fcn.0040793c
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x4b5eb0
push 0x4b5ed4
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca31c], eax
push 0x4b5eec
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca320], eax
push 0x4b5f00
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca314], eax
push 0x4b5f10
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca318], eax
push 0x4b5f18
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca324], eax
push 0x4b5f28
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca360], eax
push 0x4b5f38
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca328], eax
push 0x4b5f54
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca32c], eax
push 0x4b5f64
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca354], eax
push 0x4b5f74
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca330], eax
push 0x4b5f88
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca334], eax
push 0x4b5fa0
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca33c], eax
push 0x4b5fac
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca338], eax
push 0x4b5fbc
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca340], eax
push 0x4b5fcc
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca344], eax
push 0x4b5fe8
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca348], eax
push 0x4b6004
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca34c], eax
push 0x4b601c
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca350], eax
push 0x4b6030
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca358], eax
push 0x4b6048
mov eax, dword [ebx]
push eax
call fcn.00407844
mov dword [0x5ca35c], eax
cmp dword [ebx], 0
je 0x4b5ebe
cmp dword [0x5ca340], 0
jne 0x4b5ec2
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x4b67dc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4b6954
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e30
call fcn.004af4a0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b6925
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5cf3f0]
cmp byte [eax], 0
je 0x4b6865
mov edx, 0x80000003
mov eax, dword [ebp - 0xc]
call fcn.0042b3f8
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.004b64f4
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
xor eax, eax
call fcn.004af2c4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4b696c
call fcn.00405164
jmp 0x4b687f
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0042b3f8
lea eax, [ebp - 8]
mov edx, 0x4b696c
call fcn.00404ec8
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0042b53c
test al, al
je 0x4b68b4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0042be70
test al, al
je 0x4b68ac
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0042bc70
mov eax, dword [ebp - 0xc]
call fcn.0042b3c8
cmp dword [ebx], 0
je 0x4b68c0
call fcn.00404850
jmp 0x4b692c
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042b3f8
lea eax, [ebp - 8]
mov edx, 0x4b696c
call fcn.00404ec8
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0042b53c
test al, al
je 0x4b690f
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0042be70
test al, al
je 0x4b6907
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0042bc70
mov eax, dword [ebp - 0xc]
call fcn.0042b3c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b692c
mov eax, dword [ebp - 0xc]
call fcn.00403ef0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b695b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404e54
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x4b72f8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b73d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call fcn.004b503c
mov eax, esi
call fcn.00404e30
push 0x40
lea eax, [ebp - 0x40]
push eax
call fcn.004b5034
lea eax, [ebp - 0x40]
push eax
call fcn.004b502c
test eax, eax
je 0x4b73be
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4b7391
push dword [esi]
cmp ebx, 0xff
jbe 0x4b7362
call fcn.00403db8
mov eax, dword [edi + ebx*4]
push dword [eax]
call fcn.004b5024
mov edx, eax
lea eax, [ebp - 0x1d4]
call fcn.00405028
push dword [ebp - 0x1d4]
push 0x4b73f0
mov eax, esi
mov edx, 3
call fcn.004051e0
inc ebx
cmp ebx, 0xff
jbe 0x4b739e
call fcn.00403db8
cmp dword [edi + ebx*4], 0
jne 0x4b7353
mov eax, dword [esi]
call fcn.0040510c
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405384
call fcn.004b5044
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b73de
lea eax, [ebp - 0x1d4]
call fcn.00404e30
ret

Function at 0x4d4fa0
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call fcn.00407f0c
movsx eax, ax
test ah, 0x80
jne 0x4d4fc1
push 1
call fcn.00407f0c
movsx eax, ax
test ah, 0x80
jne 0x4d4fc1
xor eax, eax
ret
mov al, 1
ret

Function at 0x4de1d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
test dl, dl
je 0x4de1e5
add esp, 0xfffffff0
call fcn.00404254
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0x10]
xor edx, edx
mov eax, ebx
call fcn.00403ec0
test edi, edi
jne 0x4de213
mov ecx, dword [0x5cf140]
mov dl, 1
mov eax, dword [0x4de168]
call fcn.004dda84
call fcn.004047a4
mov eax, edi
mov dword [ebx + 0x10], eax
cmp byte [eax + 0x10], 1
sete dl
lea eax, [ebp + 8]
call fcn.004e07b0
push dword [ebp + 0xc]
push dword [ebp + 8]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004dd994
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
push esi
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 8]
push eax
call fcn.0040796c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4de27a
mov ecx, dword [0x5cf864]
mov dl, 1
mov eax, dword [0x4de168]
call fcn.004dda84
call fcn.004047a4
test esi, esi
jne 0x4de2c1
mov eax, edi
mov edx, dword [0x5c879c]
call fcn.0040407c
test al, al
je 0x4de2c1
push 0
mov eax, dword [edi + 0x18]
push eax
call fcn.004077fc
mov esi, eax
cmp esi, 0xffffffff
jne 0x4de2c1
mov eax, dword [ebp - 8]
push eax
call fcn.00407a1c
mov ecx, dword [0x5cf6c8]
mov dl, 1
mov eax, dword [0x4de168]
call fcn.004dda84
call fcn.004047a4
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00420a0c
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0x14]
mov edx, ebx
call fcn.0041cf34
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4de2f1
call fcn.004042ac
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4de700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4de7b6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004052dc
push eax
call fcn.00407a8c
mov edi, eax
test edi, edi
jbe 0x4de7a0
lea eax, [ebp - 4]
mov edx, edi
call fcn.0040556c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.004052dc
push eax
call fcn.00407a84
test eax, eax
je 0x4de7a0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4de7c8
mov eax, dword [ebp - 4]
push eax
call fcn.00407a94
test eax, eax
je 0x4de7a0
cmp dword [ebp - 0xc], 0x34
jne 0x4de7a0
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de7bd
lea eax, [ebp - 4]
call fcn.00404e30
ret

Function at 0x4e0854
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e0a34
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.004de814
lea eax, [ebp - 0x28]
push eax
call fcn.00407884
mov eax, dword [ebp - 0x14]
mov dword [0x5cb7cc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x5cb7d0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x5cb7d4], eax
mov eax, dword [0x5cf9e4]
cmp dword [eax], 2
sete byte [0x5caf98]
push 0x4e0a40
call fcn.00407834
lea edx, [ebp - 4]
call fcn.004de5bc
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x5caf98], 0
jne 0x4e08e3
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004de700
test al, al
je 0x4e08e3
mov eax, dword [ebp - 0x4c]
mov dword [0x5d5768], eax
jmp 0x4e08ea
xor eax, eax
mov dword [0x5d5768], eax
call fcn.004e050c
and eax, 0x7f
cmp eax, 0x12
ja case.0x4e08fb.0
jmp dword [eax*4 + 0x4e0902]
mov byte [0x5caf84], 1
jmp case.0x4e08fb.0
mov byte [0x5caf88], 1
jmp case.0x4e08fb.0
mov byte [0x5caf8c], 1
jmp case.0x4e08fb.0
mov byte [0x5caf90], 1
jmp case.0x4e08fb.0
mov byte [0x5caf94], 1
jmp case.0x4e08fb.0
mov byte [0x5caf9c], 1
mov byte [0x5cafa0], 1
jmp case.0x4e08fb.0
mov byte [0x5caf9c], 1
mov byte [0x5cafa4], 1
jmp case.0x4e08fb.0
mov byte [0x5caf9c], 1
mov byte [0x5cafa4], 1
mov byte [0x5cafa8], 1
jmp case.0x4e08fb.0
mov byte [0x5cafac], 1
jmp case.0x4e08fb.0
mov byte [0x5cafb0], 1
jmp case.0x4e08fb.0
mov byte [0x5cafb4], 1
jmp case.0x4e08fb.0
mov byte [0x5cafb8], 1
jmp case.0x4e08fb.0
mov byte [0x5cafbc], 1
jmp case.0x4e08fb.0
mov byte [0x5cafc0], 1
jmp case.0x4e08fb.0
mov byte [0x5cafc4], 1
jmp case.0x4e08fb.0
mov byte [0x5cafc8], 1
jmp case.0x4e08fb.0
mov byte [0x5cafcc], 1
jmp case.0x4e08fb.0
mov byte [0x5cafd0], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0a3b
lea eax, [ebp - 4]
call fcn.00404e30
ret
Function at 0x4e28f8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4e295c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call fcn.0040781c
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004050a0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040778c
mov edx, eax
pop eax
call fcn.0040a5dc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2963
lea eax, [ebp - 0xc]
call fcn.00404e30
ret

Function at 0x4e3114
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4e312c
add esp, 0xfffffff0
call fcn.00404254
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4e3211
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 8], 0
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.00404e84
test esi, esi
jne 0x4e317e
xor eax, eax
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4e2e44]
call fcn.004e3060
mov dword [ebx + 4], eax
mov eax, 0x10
call fcn.00402f10
mov dword [ebx + 0x14], eax
jmp 0x4e31ec
push 0
push 0
lea eax, [ebp - 8]
mov ecx, esi
mov edx, 0x4e3244
call fcn.00405164
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4e2e44]
call fcn.004e3060
mov edi, eax
mov dword [ebx + 4], edi
movzx eax, byte [edi + 4]
mov byte [ebx + 8], al
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 0x4e325c
call fcn.00405164
mov eax, dword [ebp - 0xc]
call fcn.004052dc
push eax
push 0x10
push 0
push 4
push 0
push 0xffffffffffffffff
call fcn.004076c4
mov edi, eax
mov dword [ebx + 0xc], edi
push 0
push 0
push 0
push 2
push edi
call fcn.0040796c
mov dword [ebx + 0x14], eax
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.004e335c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3218
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404e54
ret

Function at 0x4e3640
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], edx
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x4e3594
call fcn.00407edc
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x4e3d00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004052dc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push eax
push 0x4e3c1c
call fcn.00407edc
cmp eax, 1
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e8088
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4e80b6
mov eax, ebx
call fcn.004e8b3c
cmp dword [ebx + 0x40], 0
je 0x4e80af
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4e8127
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4e8119
cmp dword [ebx + 8], 0
je 0x4e80d8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4e80ea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e8119
cmp dword [ebx + 8], 0
je 0x4e80cb
cmp eax, 3
je 0x4e80fd
dec eax
jne 0x4e80cb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e80cb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4e80cb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4e8145
cmp dword [ebx + 0x14], 0xcc
je 0x4e8145
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e8150
pop ebx
ret

Function at 0x512c54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x512d28
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x512d0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
mov esi, eax
push esi
push ebx
call fcn.0040767c
mov eax, dword [ebp - 0xc]
call fcn.00402f10
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x512cf6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push ebx
call fcn.0040767c
mov ecx, edi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00512d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x512cfd
mov eax, dword [ebp - 8]
call fcn.00402f44
ret
Function at 0x5198c4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
mov eax, dword [ebp - 8]
call fcn.004052cc
xor eax, eax
push ebp
push 0x5199bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0xffffffff
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004052dc
push eax
call fcn.005196a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x5199a1
xor eax, eax
push ebp
push 0x51999a
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
mov eax, dword [ebp - 4]
call fcn.004052dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.005196ac
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x519983
xor eax, eax
push ebp
push 0x51997c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.005196bc
test eax, eax
je 0x519965
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519983
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051968c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5199a1
mov eax, dword [ebp - 0xc]
push eax
call fcn.0051968c
ret
mov ebx, dword [ebp - 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5199c6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret

Function at 0x519aec
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x519af5
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4828], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x519c0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
push 0x80000000
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
push eax
call fcn.005196a4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jbe 0x519bee
xor eax, eax
push ebp
push 0x519be7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4800
lea eax, [ebp - 0x4824]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00519694
mov esi, dword [ebp - 0x20]
dec esi
test esi, esi
jl 0x519bc6
inc esi
lea ebx, [ebp - 0x4820]
lea eax, [ebp - 0x4828]
mov edx, dword [ebx]
call fcn.00405028
mov edx, dword [ebp - 0x4828]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x24
dec esi
jne 0x519ba6
cmp dword [ebp - 0x1c], 0
jne 0x519b6e
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519bee
mov eax, dword [ebp - 0x18]
push eax
call fcn.0051968c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519c16
lea eax, [ebp - 0x4828]
call fcn.00404e30
lea eax, [ebp - 4]
call fcn.00404e30
ret
Function at 0x519c24
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
mov eax, dword [ebp - 8]
call fcn.004052cc
xor eax, eax
push ebp
push 0x519e46
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
push eax
call fcn.005196a4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x519e1e
xor eax, eax
push ebp
push 0x519e17
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 8]
call fcn.004052dc
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.005196ac
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x519e00
xor eax, eax
push ebp
push 0x519df9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.005196b4
mov eax, dword [ebp - 0x18]
call fcn.00402f10
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x519ddb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.005196b4
test eax, eax
je 0x519dc5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0xc]
call fcn.00405028
lea eax, [esi + 0x10]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x10]
call fcn.00405028
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
call fcn.00404e30
lea eax, [esi + 0x1c]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x1c]
call fcn.00405028
lea eax, [esi + 0x20]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x20]
call fcn.00405028
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x519dc1
jmp 0x519dbc
mov edi, ebx
jmp 0x519d75
inc ebx
cmp byte [ebx], 0
jne 0x519d74
cmp edi, ebx
jae 0x519dbb
cmp dword [esi + 0x18], 0
je 0x519d91
lea eax, [esi + 0x18]
mov edx, 0x519e60
call fcn.00405118
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov edx, edi
call fcn.00405028
mov eax, dword [ebp - 0x24]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00405344
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x18]
call fcn.00405118
inc ebx
cmp byte [ebx], 0
jne 0x519d70
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519de2
mov eax, dword [ebp - 0x1c]
call fcn.00402f44
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519e1e
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051968c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519e4d
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404e54
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x51a538
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffec
xor ebx, ebx
push esp
push 0x28
call fcn.004077a4
push eax
call fcn.0040761c
test eax, eax
je 0x51a592
lea eax, [esp + 8]
push eax
push 0x51a59c
push 0
call fcn.0040760c
test eax, eax
je 0x51a592
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call fcn.0040757c
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x14
pop ebx
ret

Function at 0x51a5b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
test dl, dl
je 0x51a5be
add esp, 0xfffffff0
call fcn.00404254
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004b7f6c
movzx eax, byte [0x51a618]
mov byte [esi + 0xfc], al
mov eax, dword [0x5cf9e4]
cmp dword [eax], 2
jne 0x51a5fb
mov eax, 0x51a624
call fcn.004aef30
mov eax, 0x51a640
call fcn.004aef30
call fcn.004b5d04
mov eax, esi
test bl, bl
je 0x51a610
call fcn.004042ac
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x523990
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 1], 0
cmp ebx, 0xffffffff
je 0x5239fe
xor eax, eax
push ebp
push 0x5239f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x2d1080
push ebx
call fcn.004076ec
test eax, eax
je 0x5239df
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5239fe
call fcn.0040780c
mov dword [0x5d8b08], eax
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret