joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d669c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d6806
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4d67e0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetCurrentProcess
mov cl, 1
mov edx, 0x4d681c
call fcn.004d610c
xor edx, edx
mov eax, 2
call fcn.00483270
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4d67d9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.00483290
jmp 0x4d67ba
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x128]
call fcn.004d6458
cmp dword [ebp - 8], 0
je 0x4d6789
push dword [ebp - 8]
push 0x4d6838
mov eax, dword [ebp - 0x128]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x138]
call fcn.00408be4
push dword [ebp - 0x138]
push 0x4d6844
lea eax, [ebp - 0x134]
mov edx, 4
call fcn.00404588
mov edx, dword [ebp - 0x134]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d67ac
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404478
mov edx, dword [ebp - 0x13c]
mov eax, ebx
ret
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004832b0
test eax, eax
jne 0x4d672e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d67e0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d680d
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.0040422c
lea eax, [ebp - 8]
call fcn.00404208
ret
Function at 0x4db264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db37a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.004046c8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4db34e
cmp dword [ebp - 4], 7
jne 0x4db336
mov eax, dword [ebp - 8]
call fcn.00402704
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4db32f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, ebx
call fcn.004046c8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0xc]
jmp 0x4db314
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404400
mov edx, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x4db2f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db364
mov eax, dword [ebp - 0xc]
call fcn.00402724
ret
mov ecx, 0x4db390
mov dl, 1
mov eax, dword [0x497cb4]
call fcn.0040c5a4
call fcn.00403bc0
jmp 0x4db364
mov ecx, 0x4db3b0
mov dl, 1
mov eax, dword [0x407aa8]
call fcn.0040c5a4
call fcn.00403bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db381
lea eax, [ebp - 0x10]
call fcn.00404208
ret
Function at 0x4e4420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4e4503
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402704
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4174c4]
call fcn.004033c4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e44d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
call fcn.0040a758
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x10]
mov eax, 0x4e4518
call fcn.0040b400
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov edx, 0x4e452c
call fcn.004acbdc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004e7780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e44e0
mov eax, dword [ebp - 0xc]
call fcn.004033f4
mov eax, dword [ebp - 4]
call fcn.00402724
ret
Function at 0x4e6a6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046b8
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4e6bee
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00483270
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00483290
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4e6bba
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404478
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409270
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408774
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408774
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404614
je 0x4e6b8c
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404478
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408774
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408774
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404614
jne 0x4e6bab
mov eax, dword [edi + 8]
call fcn.004d7b40
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004832b0
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4e6aed
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6bf5
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040422c
lea eax, [ebp - 4]
call fcn.00404208
ret
Function at 0x4e712c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e72de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00404208
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x8c]
sub eax, 1
jb 0x4e7181
je 0x4e7193
dec eax
je 0x4e71e3
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e72f4
call fcn.004042a0
jmp 0x4e72b9
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x4e71ad
sub eax, 9
je 0x4e71bf
sub eax, 0x50
je 0x4e71d1
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7304
call fcn.004042a0
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7314
call fcn.004042a0
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7324
call fcn.004042a0
jmp 0x4e72b9
mov eax, dword [ebp - 0x98]
cmp eax, 4
ja 0x4e7200
lea eax, [ebp - 4]
mov edx, 0x4e7334
call fcn.004042a0
jmp 0x4e72b9
cmp eax, 5
jne 0x4e724a
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x4e721a
je 0x4e722c
dec eax
je 0x4e723b
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7344
call fcn.004042a0
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7354
call fcn.004042a0
jmp 0x4e72b9
lea eax, [ebp - 4]
mov edx, 0x4e7364
call fcn.004042a0
jmp 0x4e72b9
cmp eax, 6
jne 0x4e72b9
call fcn.00497e14
test al, al
je 0x4e7267
lea eax, [ebp - 8]
mov edx, 0x4e7374
call fcn.004042a0
jmp 0x4e7274
lea eax, [ebp - 8]
mov edx, 0x4e7380
call fcn.004042a0
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x4e7283
je 0x4e729f
jmp 0x4e72b9
push 0x4e738c
push dword [ebp - 8]
push 0x4e73a0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404588
jmp 0x4e72b9
push 0x4e73ac
push dword [ebp - 8]
push 0x4e73a0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404588
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040425c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e72e5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040422c
ret
Function at 0x4e8678
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4e8680
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e883a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402704
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4174c4]
call fcn.004033c4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e880b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404400
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4e8850
call fcn.00404514
mov eax, dword [ebp - 0xc]
call fcn.00409000
test al, al
je 0x4e87a2
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x18]
mov edx, 0x4e8870
mov eax, dword [ebp - 8]
call fcn.004accfc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.004042a0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404728
mov eax, dword [ebp - 0x1c]
call fcn.00408c34
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 2
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.00404728
mov eax, dword [ebp - 0x20]
call fcn.00408c34
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 2
mov edx, 7
mov eax, dword [ebp - 8]
call fcn.00404728
mov eax, dword [ebp - 0x24]
call fcn.00408c34
mov edi, eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0040a594
fstp qword [0x514144]
wait
jmp 0x4e87ed
call fcn.0040a758
fstp qword [0x514144]
wait
call fcn.0040a758
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x28]
mov eax, 0x4e889c
call fcn.0040b400
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 8]
mov edx, 0x4e8870
call fcn.004acbdc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8812
mov eax, dword [ebp - 0x10]
call fcn.004033f4
mov eax, dword [ebp - 4]
call fcn.00402724
ret

Function at 0x4e88a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e8938
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.004095f8
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404728
mov edx, dword [ebp - 0x110]
mov eax, ebx
mov ecx, 0x4e894c
call fcn.00404514
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e893f
lea eax, [ebp - 0x110]
call fcn.00404208
lea eax, [ebp - 4]
call fcn.00404208
ret
Function at 0x4e9ef8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffffac
mov ebx, eax
push 0x51
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x51
call fcn.00404478
add esp, 0x54
pop ebx
ret

Function at 0x4e9f20
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004095f8
add esp, 0x108
pop ebx
ret

Function at 0x4e9f4c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4e9ffa
push 0xf01ff
mov eax, ebx
call fcn.004046c8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4e9ffa
xor eax, eax
push ebp
push 0x4e9fd7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e9ffa
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ea004
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4ea0b3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404400
mov eax, dword [ebp - 0x1c]
mov edx, 0x4ea0cc
call fcn.00404614
jne 0x4ea076
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov esi, eax
mov dword [ebp - 0xc], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea0ba
lea eax, [ebp - 0x1c]
call fcn.00404208
ret
Function at 0x4ea0e0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004d7b40
test al, al
je 0x4ea0f5
mov bl, 1
jmp 0x4ea11c
push 0x4ea124
call fcn.004ea004
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4ea11c
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4ea24c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046b8
lea ebx, [ebp - 0x150]
xor eax, eax
push ebp
push 0x4ea486
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4ea451
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 1
lea eax, [ebp - 0x154]
push eax
mov eax, dword [ebp - 4]
call fcn.004044c8
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.00404728
mov eax, dword [ebp - 0x154]
mov edx, 0x4ea4a0
call fcn.00404614
jne 0x4ea2f1
mov eax, dword [ebp - 4]
call fcn.004044c8
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404768
push ebx
lea eax, [ebp - 0x158]
mov ecx, 0x4ea4ac
mov edx, dword [ebp - 4]
call fcn.00404514
mov eax, dword [ebp - 0x158]
call fcn.004046c8
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
setne al
jmp 0x4ea432
cmp byte [0x51415c], 2
je 0x4ea43a
mov eax, dword [0x51297c]
mov eax, dword [eax]
call fcn.00481930
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404478
mov eax, dword [ebx]
test eax, eax
jbe 0x4ea422
cmp eax, 0x2328
jae 0x4ea422
mov eax, dword [ebp - 0xc]
mov edx, 0x4ea4bc
call fcn.00404614
je 0x4ea422
mov eax, dword [ebp - 0xc]
mov edx, 0x4ea4c8
call fcn.00404614
je 0x4ea422
push dword [ebp - 4]
push 0x4ea4a0
push dword [ebp - 0xc]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x15c]
call fcn.00409010
test al, al
je 0x4ea3f2
push dword [ebp - 4]
push 0x4ea4a0
push dword [ebp - 0xc]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x160]
call fcn.004ea24c
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x4ea3f2
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
call fcn.00403c6c
jmp 0x4ea458
push dword [ebp - 4]
push 0x4ea4a0
push dword [ebp - 0xc]
lea eax, [ebp - 0x164]
mov edx, 3
call fcn.00404588
mov eax, dword [ebp - 0x164]
call fcn.00409000
test al, al
je 0x4ea422
mov byte [ebp - 5], 0
jmp 0x4ea43a
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ea325
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea458
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea48d
lea eax, [ebp - 0x164]
mov edx, 5
call fcn.0040422c
lea eax, [ebp - 0xc]
call fcn.00404208
lea eax, [ebp - 4]
call fcn.00404208
ret
Function at 0x4ea4cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046b8
xor eax, eax
push ebp
push 0x4ea58d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4ea56b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402cf8
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402cf8
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.004094a4
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ea577
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea594
lea eax, [ebp - 4]
call fcn.00404208
ret

Function at 0x4ea7ac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046b8
xor eax, eax
push ebp
push 0x4ea834
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x4ea84c
mov edx, dword [ebp - 4]
call fcn.00404514
mov eax, dword [ebp - 0x28]
call fcn.004046c8
mov dword [ebp - 0x1a], eax
xor eax, eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], 0x450
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x4ea814
mov bl, 1
jmp 0x4ea816
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea83b
lea eax, [ebp - 0x28]
call fcn.00404208
lea eax, [ebp - 4]
call fcn.00404208
ret
Function at 0x4eaa54
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eab6b
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4eab4a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetCurrentProcess
mov cl, 1
mov edx, 0x4eab80
call fcn.004ea8f0
xor edx, edx
mov eax, 2
call fcn.00483270
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4eab43
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.00483290
jmp 0x4eab28
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x128]
call fcn.004ea9ac
cmp dword [ebp - 8], 0
je 0x4eaaf7
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4eab1a
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404478
mov edx, dword [ebp - 0x134]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004832b0
test eax, eax
jne 0x4eaad7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eab4a
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eab72
lea eax, [ebp - 0x134]
call fcn.00404208
lea eax, [ebp - 8]
call fcn.00404208
ret

Function at 0x4eadb8
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004ead88
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4eae4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eaf54
test al, al
jne 0x4eae36
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eada8
mov ebx, eax
test ebx, ebx
je 0x4eae2c
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x4eae25
mov dword [ebp - 8], 2
jmp 0x4eae2c
mov dword [ebp - 8], 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ead6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eae56
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004ead98
ret
Function at 0x4eae60
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004ead88
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4eaf0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eaf54
test al, al
jne 0x4eaef2
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eaf74
test al, al
jne 0x4eaeeb
mov ecx, ebx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004eada8
mov ebx, eax
test ebx, ebx
je 0x4eaedf
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4eaed8
mov dword [ebp - 8], 2
jmp 0x4eaedf
mov dword [ebp - 8], 3
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ead6c
jmp 0x4eaef2
mov dword [ebp - 8], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eaf12
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004ead98
ret

Function at 0x4eaf1c
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
xor ebx, ebx
test edx, edx
jbe 0x4eaf4b
mov eax, esi
call fcn.004eada8
mov edi, eax
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4eaf42
mov ebx, dword [esp + 4]
mov edx, edi
mov eax, esi
call fcn.004ead6c
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret