joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458c30
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x298], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x458d82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x193]
push eax
push 0x101
call sub.WS2_32.DLL_WSAStartup
xor ecx, ecx
push ebp
push 0x458d5a
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x293]
push eax
call sub.WS2_32.DLL_gethostname
lea eax, [ebp - 0x293]
mov edx, dword [ebp - 4]
call fcn.00409d28
lea eax, [ebp - 0x293]
push eax
call sub.WS2_32.DLL_gethostbyname
test eax, eax
je 0x458d43
mov edx, dword [eax + 0xc]
test edx, edx
je 0x458d3d
mov ebx, dword [edx]
test ebx, ebx
je 0x458d37
lea eax, [ebp - 0x298]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 0x29c], 0
lea edx, [ebp - 0x2b8]
mov ecx, 3
mov eax, 0x458d9c
call fcn.0040a36c
mov edx, dword [ebp - 0x298]
mov eax, esi
call fcn.00404b80
mov byte [ebp - 5], 1
jmp 0x458d47
mov byte [ebp - 5], 0
jmp 0x458d47
mov byte [ebp - 5], 0
jmp 0x458d47
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458d61
call sub.WS2_32.DLL_WSACleanup
ret

Function at 0x458da8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458e48
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004032b8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x458e60
mov edx, ebx
call fcn.00404e38
mov eax, dword [ebp - 0x24]
call fcn.00404fec
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x458e60
mov edx, esi
call fcn.00404e38
mov eax, dword [ebp - 0x28]
call fcn.00404fec
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e4f
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404b50
ret
Function at 0x458f08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458fa0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404d9c
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.00404dec
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.0040504c
mov eax, dword [ebp - 0x104]
mov edx, 0x458fb4
call fcn.00404f38
je 0x458f87
mov eax, ebx
mov edx, 0x458fb4
call fcn.00404df4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458fa7
lea eax, [ebp - 0x104]
call fcn.00404b2c
ret

Function at 0x458fb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45902c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404d9c
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x459040
call fcn.00404e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459033
lea eax, [ebp - 0x108]
call fcn.00404b2c
ret

Function at 0x459044
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4590f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jne 0x459088
mov byte [ebp - 0x100], 0x43
mov al, byte [ebp - 0x100]
push eax
call sub.user32.dll_IsCharAlphaA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4590a5
mov byte [ebp - 0x100], 0x43
lea eax, [ebp - 0x104]
call fcn.00459564
mov eax, dword [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
mov dl, byte [ebp - 0x100]
call fcn.00404d14
mov edx, dword [ebp - 0x108]
mov eax, ebx
pop ecx
call fcn.00404e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4590fb
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00404b50
ret
Function at 0x459248
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4593a0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 7
ja case.default.0x459285
jmp dword [eax*4 + 0x45928c]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
call fcn.00459638
mov eax, dword [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
mov dl, byte [ebp - 0x104]
call fcn.00404d14
mov edx, dword [ebp - 0x10c]
mov eax, ebx
pop ecx
call fcn.00404e38
jmp case.default.0x459285
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
call fcn.004596e4
mov eax, dword [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
mov dl, byte [ebp - 0x104]
call fcn.00404d14
mov edx, dword [ebp - 0x114]
mov eax, ebx
pop ecx
call fcn.00404e38
jmp case.default.0x459285
mov eax, ebx
call fcn.00458f08
jmp case.default.0x459285
mov eax, ebx
call fcn.00458fb8
jmp case.default.0x459285
mov eax, ebx
mov edx, 0x4593b4
call fcn.00404b80
jmp case.default.0x459285
mov eax, ebx
mov edx, 0x4593c0
call fcn.00404b80
jmp case.default.0x459285
mov eax, ebx
mov edx, 0x4593cc
call fcn.00404b80
jmp case.default.0x459285
mov eax, ebx
mov edx, dword [0x4a06c8]
mov edx, dword [edx]
call fcn.00404d24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593a7
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404b50
ret
Function at 0x45a100
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45a269
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404bc4
mov eax, dword [ebp - 0x10]
call fcn.00459d8c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45a152
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040508c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045a780
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45a227
xor eax, eax
push ebp
push 0x45a220
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00459efc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0045a298
test al, al
je 0x45a1fe
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404c1c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x45a1fe
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404fec
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x45a1f8
mov eax, dword [ebp - 0x14]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00404d24
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0045a100
dec ebx
cmp ebx, 0xffffffff
jne 0x45a1b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a227
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00459efc
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404fec
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00459ee8
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a270
lea eax, [ebp - 0x3c]
call fcn.00404b2c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404b50
ret

Function at 0x45a298
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004032b8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4a0838]
cmp byte [edx + 0xc], 0
je 0x45a2fc
mov edx, dword [0x4a0828]
cmp dword [edx], 2
jne 0x45a2fc
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x45a300
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45a3b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045a298
test al, al
je 0x45a39a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404c1c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x45a39a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404d24
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x45a353
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a3bf
lea eax, [ebp - 0x2c]
call fcn.00404b2c
lea eax, [ebp - 0xc]
call fcn.00404b2c
ret

Function at 0x45a3c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45a480
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045a298
test al, al
je 0x45a462
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404c1c
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x45a462
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404d24
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x45a41b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a487
lea eax, [ebp - 0x2c]
call fcn.00404b2c
lea eax, [ebp - 0xc]
call fcn.00404b2c
ret
Function at 0x45a694
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00459da0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404fec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45a6f2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a04fc]
mov dl, 1
mov eax, dword [0x459b34]
call fcn.0040ce44
call fcn.004044e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45a6fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404fec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45a754
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a0844]
mov dl, 1
mov eax, dword [0x459b34]
call fcn.0040ce44
call fcn.004044e4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00459dd0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45aa4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45ab63
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00459efc
xor eax, eax
push ebp
push 0x45ab3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045a298
test al, al
je 0x45ab22
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0045a92c
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404c1c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x45ab22
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
jne 0x45ab1e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00404d24
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0045a92c
pop ecx
inc edi
dec ebx
jne 0x45aad3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ab45
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00459efc
ret
Function at 0x45ab74
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45adb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.00459efc
xor eax, eax
push ebp
push 0x45ad8b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045a298
test al, al
je 0x45ad6f
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404c1c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x45ad6f
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404fec
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x45ad63
mov eax, dword [ebp - 0x14]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00404d24
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045a780
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x45ad63
xor eax, eax
push ebp
push 0x45ad5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00459efc
xor eax, eax
push ebp
push 0x45ad3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00404d24
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00459f00
mov eax, dword [ebp - 0x14]
call fcn.00404fec
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00404d24
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045a780
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x45ad1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0045aa4c
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0045ab74
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad22
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x45abff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad92
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00459efc
ret
Function at 0x45c87c
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
mov eax, dword [ebp - 8]
call fcn.00404fdc
mov eax, dword [ebp - 0xc]
call fcn.00404fdc
mov eax, dword [ebp + 8]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x45c9ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x45c9e0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404fec
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00404fec
push eax
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
mov eax, dword [0x4a07b4]
cmp dword [eax], 0
je 0x45c9a3
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.0040504c
mov eax, 4
call fcn.0040272c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
call fcn.00404dec
inc eax
call fcn.0040272c
mov esi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
xor eax, eax
push ebp
push 0x45c99c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.00409d28
mov eax, dword [ebp - 0x14]
push eax
push 1
push ebx
mov eax, dword [0x4a07b4]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c9a3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0040274c
mov eax, dword [ebp - 0x14]
call fcn.0040274c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c9d5
lea eax, [ebp - 0x18]
call fcn.00404b2c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b50
lea eax, [ebp + 8]
call fcn.00404b2c
ret

Function at 0x45c9e4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fdc
xor eax, eax
push ebp
push 0x45ca96
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45ca76
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0xf003f
push 0
push 0x45caa8
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x45ca5e
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404fec
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x45ca58
push edi
call sub.advapi32.dll_DeleteService
mov esi, 1
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jle 0x45ca68
mov byte [ebp - 5], 1
jmp 0x45ca6c
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ca80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ca9d
lea eax, [ebp - 4]
call fcn.00404b2c
ret
Function at 0x45cae0
Capabilities:
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, eax
mov byte [esp], 1
mov eax, ebx
call fcn.0045cce0
mov esi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push esi
lea esi, [eax*4 + 0x4a1d2c]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 4]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x45cb2d
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x45cb33
push esi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x45cb40
Capabilities:
Pause service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, eax
mov byte [esp], 1
mov eax, ebx
call fcn.0045cce0
mov esi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push esi
lea esi, [eax*4 + 0x4a1d2c]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 4]
push eax
push 2
push esi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x45cb8d
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x45cb93
push esi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x45cba0
Capabilities:
Continue service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov ebx, eax
mov byte [esp], 1
mov eax, ebx
call fcn.0045cce0
mov esi, eax
xor eax, eax
mov al, bl
lea eax, [eax + eax*8]
push esi
lea esi, [eax*4 + 0x4a1d2c]
lea edi, [esp + 8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [esp + 4]
push eax
push 3
push esi
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x45cbed
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [esp], 0
jmp 0x45cbf3
push esi
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [esp]
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x45cc40
Capabilities:
Modify service

Disassembly:
push ebx
push esi
mov bl, 1
call fcn.0045cce0
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0x45cc73
push esi
call sub.advapi32.dll_CloseServiceHandle
xor ebx, ebx
jmp 0x45cc79
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45cd6c
Capabilities:
Query service configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffbfc
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404b2c
mov eax, ebx
call fcn.0045cce0
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0x400
call fcn.00407a64
push esp
push 0x400
lea eax, [esp + 0xc]
push eax
push 1
push ebx
call sub.ADVAPI32.DLL_QueryServiceConfig2A
test al, al
je 0x45cdb8
mov eax, esi
lea edx, [esp + 8]
call fcn.00404d24
push ebx
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x404
pop esi
pop ebx
ret