joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436bda
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x436ca1
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436c34
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 0x11aa
call fcn.00436d15
add esp, 0xc
jmp 0x436c9f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x436c7a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x436c9f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x436c9f
push 0x22c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x436d11
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x436ce3
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x50]
push 0x48d3
call fcn.0042dd3f
add esp, 0xc
jmp 0x436d11
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
push 0x3793
mov eax, dword [ebp - 0x60]
push dword [eax]
push 1
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push 1
call fcn.0042d8d6
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x439110
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x4391d4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x439177
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004391ff
add esp, 0x10
jmp 0x4391d2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x439197
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x4391d2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4391d2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x13f5
push 0x14b2
push 0xe93
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4391fb
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push 0
push 1
push dword [ebp - 0x3c]
push 0x50aa
call fcn.00436142
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x439ad8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x439b51
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x439b0c
push 1
call fcn.00439b72
pop ecx
jmp 0x439b4f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x439b2c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x439b4f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x439b4f
push 0
push 0x15bb
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x439b6e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 0x6655
push dword [ebp - 0x20]
push 0x5a8a
push 0
call fcn.0043bef7
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43bd8c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x43beeb
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43be86
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43be0e
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x43be84
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
push dword [eax]
push 0
push 0x2fc7
push 0x2558
push 0xc5c
push 0x6138
push 0
mov eax, dword [ebp - 0x4c]
push dword [eax]
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
push dword [eax]
push 0x2e2e
push 0x398f
push 0x7a28
push 0x60a0
call fcn.0043ed2c
add esp, 0x38
jmp 0x43bee9
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x43beb5
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43bee9
mov byte [ebp - 1], 0
push 0x5ca8
push 0x2ba3
push 0x153a
push 0
push 0x27e3
push 0
push 0x4b7
lea eax, [ebp - 1]
push eax
push 1
push 0x36ac
call fcn.00436a1c
add esp, 0x28
jmp 0x43bef3
push 0
call fcn.00436577
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43d513
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43d5c4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43d5a3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43d58d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x43d5a1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43d5a1
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x43d5c2
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push 0x1cf2
push dword [ebp - 0x38]
push 0
push 0x15ef
call fcn.00444381
add esp, 0x14
jmp 0x43d5e5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
push 0x67a
call fcn.0043741d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4418c3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4419a3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x441953
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x441949
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x441947
push 0x647d
push 0
push 0x6aac
push 0x452a
push 1
push 1
push 1
push 0x583e
call fcn.00442acb
add esp, 0x20
jmp 0x441951
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x44199e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 1
push 0x15a5
push 1
push 0x22f3
push 0x60bd
push 0x6ced
push 0xf19
push 0x3f40
push dword [ebp - 0x2c]
push 1
push 0x7fd1
push 0x7acf
push 0x6093
push 0x3126
push 1
call fcn.004397ee
add esp, 0x3c
jmp 0x441a4f
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x441a35
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x441a24
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4419fd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x441a22
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x441a20
push 0
push 0x2030
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x4419f2
jmp 0x441a33
push 0x22c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x441a4f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 1
push 0x33ae
push dword [ebp - 0x4c]
push 0
call fcn.0042d41c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x442acb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x442b0c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x15f7
push dword [ebp - 0x10]
push 1
call fcn.00442be6
add esp, 0x14
jmp 0x442be2
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x442bc1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x442b5b
push 0
push 0x922
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x442bbf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x442b7d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x19
jl 0x442bbf
push 0x2a01
push 1
push 0x6d0e
push 0x46db
push 0x47ad
push 0x4fca
push 0x4f76
push 0
push 0
push 1
push 0x5b0d
push 0x414e
call fcn.0043e605
add esp, 0x30
jmp 0x442b72
jmp 0x442be2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x3ff5
push dword [ebp - 0x30]
push 0x40d7
push 1
push 1
push 0
call fcn.004417f8
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4506ba
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x450746
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45070d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 0x7b9d
push 1
push dword [ebp - 0x18]
call fcn.0045075e
add esp, 0x10
jmp 0x450744
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x450729
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x450744
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x450744
push 0x22c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x45075a
push 0x7cda
push 0x768b
push 0
call fcn.00456a84
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x450e2c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x450e51
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
call fcn.00450ee2
pop ecx
pop ecx
jmp 0x450ede
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x450e8d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0x4ea1
call fcn.004521c4
add esp, 0xc
jmp 0x450ede
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x450ec3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x450ec1
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x450ede
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x450ede
push 0x22c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret
Function at 0x451ca5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x451d40
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x451cf7
push 0x5e74
push 0x6c72
push 1
push 0x261e
push 0x7bae
push 0x1f13
push 0x1345
call fcn.00451daf
add esp, 0x1c
jmp 0x451d3e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x451d38
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x451d36
push 0x291
push 0x4964
push 0x10bb
push 0x452b
push 0x462f
push 0
call fcn.00453f26
add esp, 0x18
jmp 0x451d3e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x451dab
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x451da3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x451d88
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x451d86
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x451da1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x11
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x451dab
push 0
call fcn.00451e21
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x458196
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x458280
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x458226
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4581ff
mov byte [ebp - 1], 0
push 0x5517
push 1
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0
call fcn.00457485
add esp, 0x18
jmp 0x458224
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x458224
push 0
push 0xd39
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x45827e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x458276
mov byte [ebp - 2], 0
push 1
push 0x6b20
push 0
lea eax, [ebp - 2]
push eax
push 0x6fb3
push 0
push 0x554a
push 0x6fae
push 0x51ff
push 0x2d29
push 0x1c9d
push 0xa5
call fcn.004576f8
add esp, 0x30
jmp 0x45827e
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x4582a8
push 0x2014
push 1
push 0x459d
push 0x58c4
push 0x63d7
push 0x4be8
push 0x31ca
call fcn.0044fb6d
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x45ab3d
Capabilities:
Delete directory
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45ab6e
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
push 1
push 0x1bd1
push 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
call fcn.0045ac1b
add esp, 0x10
jmp 0x45ac17
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45aba0
push 0x77e5
push 0
call fcn.0045615d
pop ecx
pop ecx
jmp 0x45ac17
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x45abdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x45abda
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x45ac17
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x45ac17
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x13f5
push 0x14b2
push 0xe93
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x45afbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x45afd7
push 1
call fcn.0045b0a7
pop ecx
jmp 0x45b0a3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45b08b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x45b041
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45b03f
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x45b089
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
mov eax, dword [ebp - 0x38]
push dword [eax]
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.004703c7
push eax
mov ecx, dword [ebp - 0x40]
call fcn.0042b13e
lea ecx, [ebp - 0x60]
call fcn.00402c08
jmp 0x45b0a3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0xfcb
push 0
push dword [ebp - 0x48]
call fcn.00450b8a
add esp, 0xc
mov esp, ebp
pop ebp
ret