joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434852
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x64
mov eax, 0x4578b9
call fcn.00444333
mov eax, dword [ebp + 0xc]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.00402830
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x434904
lea ecx, [ebp + 0xc]
call fcn.004035f0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00402810
mov byte [ebp - 4], 2
push dword [eax]
push 0x1a
push 0x258a
push 0x4625ac
call fcn.00433314
add esp, 0xc
push eax
lea edi, [ebp + 0xc]
call fcn.004056f0
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004028e0
push dword [ebp + 0xc]
push 0xc
push 0x3467
push 0x4625c8
call fcn.00433314
add esp, 0xc
push eax
push dword [ebp + 8]
call fcn.004354e8
add esp, 0xc
mov ecx, edi
call fcn.004028e0
lea eax, [ebp - 0x10]
call fcn.00402e60
mov al, bl
call fcn.004443d2
ret
push 0x44
pop edi
push edi
lea eax, [ebp - 0x70]
push ebx
push eax
mov byte [ebp + 0xf], bl
call fcn.00442500
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x70], edi
cmp byte [ebp + 0x14], bl
jne 0x434934
xor eax, eax
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], ax
mov esi, 0x8000000
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00442500
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402810
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.004347a5
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004028e0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4349c4
push dword [ebp + 0x18]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, ebx
jne 0x4349b1
mov byte [ebp + 0xf], 1
cmp dword [ebp + 0x1c], ebx
je 0x4349fc
push dword [ebp + 0x1c]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
jmp 0x4349fc
cmp eax, 0x102
jne 0x4349fc
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x4349fc
mov byte [eax], 1
jmp 0x4349fc
push 0x17
push 0x184d
push 0x4625d8
call fcn.00433314
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x10]
mov edx, eax
call fcn.0040e6b0
mov byte [ebp - 4], 6
push dword [eax]
push dword [ebp + 8]
call fcn.00435566
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.004028e0
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2c], ebx
je 0x434a0c
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x28], ebx
je 0x434a16
push dword [ebp - 0x28]
call esi
lea ecx, [ebp - 0x14]
call fcn.004028e0
mov bl, byte [ebp + 0xf]
jmp 0x4348f4

Function at 0x434aeb
Capabilities:
Create directory

Disassembly:
push ecx
and dword [esp], 0
push 0
push 0x434adc
push esi
call fcn.00434a26
mov eax, dword [esi]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x434b11
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov eax, esi
pop ecx
ret
Function at 0x434b63
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0xc
mov eax, 0x455a05
call fcn.00444366
mov eax, dword [ebp + 0x114]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea esi, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edi, ecx
mov byte [ebp], bl
mov dword [ebp - 4], ebx
call fcn.00434aeb
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], ebx
je 0x434bcd
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
jne 0x434bb9
mov eax, 0x4625f0
lea edx, [ebp]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
cmp eax, ebx
jne 0x434bcd
mov byte [ebp], bl
lea ecx, [ebp - 0x14]
call fcn.004028e0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea eax, [ebp]
push eax
call fcn.00402830
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x10c
leave
ret
Function at 0x4351c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xc
call fcn.00440328
mov esi, eax
pop ecx
test esi, esi
je 0x4351ed
lea ecx, [esi + 4]
call fcn.004035f0
lea ecx, [esi + 8]
call fcn.004035f0
jmp 0x4351ef
xor esi, esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov ecx, edi
mov byte [esi], 0
call fcn.00402d80
push dword [ebp + 0xc]
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.00402d80
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push esi
push 0x435198
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov al, byte [esi]
mov ecx, ebx
mov byte [ebp - 1], al
call fcn.004028e0
mov ecx, edi
call fcn.004028e0
push esi
call fcn.0043eaaf
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43524c
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x4588ce
call fcn.00444333
xor edi, edi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x13
push 0x28f7
push 0x46267c
mov dword [ebp - 0x10], edi
call fcn.00433314
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x435394
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x31
push 0x4ab
push 0x462690
mov dword [ebp - 0x10], edi
call fcn.00433314
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x435394
push dword [ebp - 0x10]
call esi
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x13
push 0x28f7
push 0x46267c
mov dword [ebp - 0x10], edi
call fcn.00433314
add esp, 0xc
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x435394
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.00434cad
pop ecx
mov dword [ebp - 4], edi
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.00402830
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.004028e0
push 0xc
push 0x266c
push 0x4626c4
call fcn.00433314
add esp, 0xc
lea esi, [ebp - 0x14]
call fcn.0040bbb0
push edi
push 0x80
push 4
push edi
push 2
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x43538c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, esi
call fcn.00402e60
mov al, 1
jmp 0x435396
lea eax, [ebp - 0x14]
call fcn.00402e60
xor al, al
call fcn.004443d2
ret
Function at 0x435444
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, eax
mov eax, dword [esi]
push 0
push eax
mov byte [ebp - 1], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.00440ae1
mov esi, dword [esi]
pop ecx
push eax
push edi
push 0
push esi
mov dword [ebp - 8], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4354bd
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x45e5e0
push dword [ebp - 8]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4354bd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
mov word [esi], dx
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov word [edx], cx
mov word [ebx], ax
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.0043f4d3
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
test al, al
jne 0x4354e6
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [edx], cx
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov word [ebx], cx
leave
ret

Function at 0x4355b2
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
mov esi, 0x128
push esi
xor ebx, ebx
push ebx
push edi
call fcn.00442500
add esp, 0xc
push edi
push dword [esp + 0x10]
mov dword [edi], esi
call sub.KERNEL32.DLL_Process32First
jmp 0x4355e9
mov eax, dword [esp + 0x10]
cmp eax, dword [edi + 8]
je 0x4355ef
push edi
push dword [esp + 0x10]
mov dword [edi], esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x4355d4
jmp 0x4355f1
mov bl, 1
pop esi
mov al, bl
pop ebx
ret

Function at 0x435974
Capabilities:
Get mac address on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2884]
mov eax, 0x2884
call fcn.0044c2a0
push 0xffffffffffffffff
push 0x45598f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x2880], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
push 0x45e58a
mov ecx, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
call fcn.00402830
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, esi
jne 0x435a26
movzx eax, byte [ebp + esi + 0x194]
push eax
push str._02X
lea eax, [ebp - 0x10]
push 4
push eax
call fcn.00440cbe
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00402a00
cmp esi, 5
jge 0x435a20
push 0x46275c
mov ecx, edi
call fcn.00402a00
inc esi
cmp esi, 6
jl 0x4359e8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x2880]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x2884
leave
ret
Function at 0x435a49
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
sub esp, 0x204
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x204], eax
push 0xc
mov eax, 0x45594e
call fcn.00444333
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x45e58a
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call fcn.00402830
push 0x104
lea eax, [ebp + 0x100]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
lea eax, [ebp + 0x100]
push eax
mov byte [ebp + 0x103], bl
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x435ae8
push dword [ebp - 0x10]
lea eax, [ebp]
push str.0x_X
push 0x100
push eax
call fcn.00440cbe
add esp, 0x10
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00402920
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x204]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x208
leave
ret

Function at 0x435b7b
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov byte [ebp - 5], bl
cmp dword [ebp + 8], ebx
je 0x435c13
push 6
push ebx
push dword [ebp + 8]
call fcn.00442500
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
mov dword [ebp - 0xc], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x435c13
call fcn.0044caf0
mov esi, esp
cmp esi, ebx
je 0x435c13
lea eax, [ebp - 0xc]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x435c13
cmp byte [ebp - 5], bl
jne 0x435c13
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x435bec
cmp eax, 9
je 0x435bec
cmp eax, 0xf
jne 0x435c0d
cmp dword [esi + 0x190], 6
jne 0x435c0d
push 6
lea eax, [esi + 0x194]
push eax
push dword [ebp + 8]
call fcn.00442fd0
add esp, 0xc
mov byte [ebp - 5], 1
mov esi, dword [esi]
cmp esi, ebx
jne 0x435bd2
mov al, byte [ebp - 5]
lea esp, [ebp - 0x14]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043eaba
leave
ret
Function at 0x4360b7
Capabilities:
Get user security identifier

Disassembly:
push 0x1c
mov eax, 0x45591a
call fcn.00444333
mov ebx, ecx
lea ecx, [ebp - 0x24]
call fcn.004035f0
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 8
call fcn.00402b00
mov eax, dword [ebx]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push eax
push edi
call esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], edi
je 0x436178
push dword [ebp - 0x10]
call fcn.00440ae1
mov ebx, dword [ebx]
pop ecx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00402e30
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
push ebx
push edi
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
call fcn.0040a190
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
je 0x43616c
push dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
call fcn.00402920
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x43616f
mov dword [ebp - 0x14], edi
push dword [ebp - 0x20]
call fcn.0043f4d3
pop ecx
cmp dword [ebp - 0x14], edi
jne 0x436183
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea ecx, [ebp - 0x24]
call fcn.004028e0
cmp dword [ebp - 0x14], 1
sete al
call fcn.004443d2
ret
Function at 0x4362d1
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x130
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x130], eax
push 8
mov eax, 0x456abe
call fcn.00444333
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
push 0x45e58a
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ebx
call fcn.00402830
mov esi, 0x94
push esi
lea eax, [ebp + 0x9c]
push ebx
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x14], 1
call fcn.00442500
add esp, 0xc
lea eax, [ebp + 0x9c]
mov dword [ebp + 0x9c], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push eax
call esi
test eax, eax
je 0x436481
cmp dword [ebp + 0xac], ebx
jne 0x436372
push 0xa
push 0x288a
push str.RU_P_P_N
call fcn.00433314
add esp, 0xc
push eax
mov ecx, edi
call fcn.00402920
jmp 0x436481
cmp dword [ebp + 0xac], 1
jne 0x4363e2
push 7
push 0x109
push str.RU_P_
call fcn.00433314
add esp, 0xc
push eax
mov ecx, edi
call fcn.00402920
cmp dword [ebp + 0xa4], 0x5a
push 3
jb 0x4363ae
push 0x2d33
push 0x462884
jmp 0x4363cd
cmp dword [ebp + 0xa4], 0xa
jb 0x4363c3
push 0x1d3c
push 0x462888
jmp 0x4363cd
push 0xf2c
push 0x46288c
call fcn.00433314
add esp, 0xc
push eax
mov ecx, edi
call fcn.004109e0
jmp 0x436481
cmp dword [ebp + 0xac], 2
jne 0x436481
mov edi, 0x9c
push edi
lea eax, [ebp]
push ebx
push eax
call fcn.00442500
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], edi
call esi
test eax, eax
je 0x43644b
lea eax, [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x96]
push eax
movzx eax, word [ebp + 0x94]
push eax
push dword [ebp + 8]
push dword [ebp + 4]
push 0x1b
push 0x22cb
push 0x462890
call fcn.00433314
mov edi, dword [ebp - 0x10]
add esp, 0xc
push eax
call fcn.004056f0
add esp, 0x18
jmp 0x43647e
lea eax, [ebp + 0xb0]
push eax
push dword [ebp + 0xa4]
push dword [ebp + 0xa0]
push 0x13
push 0x1c15
push str.RU__
call fcn.00433314
mov edi, dword [ebp - 0x10]
add esp, 0xc
push eax
call fcn.004056f0
add esp, 0x10
mov edi, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x130]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x134
leave
ret
Function at 0x436ade
Capabilities:
Encode data using xor
Get disk information
Get mac address on windows
Hash data with crc32

Disassembly:
push ebp
lea ebp, [esp - 0x28a8]
mov eax, 0x28a8
call fcn.0044c2a0
push 0xffffffffffffffff
push 0x45699a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x28a4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x10
lea eax, [ebp + 0x2880]
mov dword [ebp - 4], esi
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], esi
call fcn.00442500
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push 4
push 0x1ff7
push 0x462904
mov dword [ebp - 0x1c], esi
call fcn.00433314
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x2880], eax
mov eax, 0x2880
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp]
push esi
push eax
call fcn.00442500
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, esi
jne 0x436bfe
mov eax, dword [ebp + 0x190]
cmp eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
jle 0x436bfe
lea ecx, [ebp - 0x18]
call fcn.004035f0
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], 1
lea ebx, [ebp + ebx + 0x194]
movzx eax, byte [ebx]
push eax
push 5
push 0x61b
push 0x46290c
call fcn.00433314
add esp, 0xc
push eax
lea edi, [ebp - 0x18]
call fcn.004056f0
mov al, byte [ebx]
mov edi, dword [ebp - 0x10]
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp + edi + 0x288a], al
call fcn.004028e0
inc edi
cmp edi, dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
jl 0x436ba2
mov ebx, dword [ebp - 0x20]
push 0x10
lea eax, [ebp + 0x2880]
push eax
lea eax, [ebp + 0x2890]
push eax
call fcn.00442fd0
add esp, 0xc
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [ebp + eax + 0x2890]
mov edi, ecx
and edi, 0xff
movzx edx, dl
xor edi, edx
shr ecx, 8
xor ecx, dword [edi*4 + 0x470498]
inc eax
cmp eax, 0x10
jb 0x436c1b
push 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x28a0]
not ecx
push eax
mov dword [ebp - 0x14], ecx
call fcn.00442fd0
add esp, 0xc
mov ecx, ebx
call fcn.004035f0
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 1
lea edi, [ebp + esi + 0x2890]
mov al, byte [edi]
shr al, 4
cmp al, 9
jbe 0x436c7e
add al, 0x37
jmp 0x436c80
add al, 0x30
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.0040a3e0
movzx eax, byte [edi]
and eax, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x436c9c
dec eax
or eax, 0xfffffff0
inc eax
cmp al, 9
jbe 0x436ca4
add al, 0x37
jmp 0x436ca6
add al, 0x30
mov byte [ebp - 0x10], al
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.0040a3e0
inc esi
cmp esi, 0x14
jl 0x436c6a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x28a4]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x28a8
leave
ret
Function at 0x437420
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 4
push 0
push 0
mov byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x437488
push esi
push edi
push 4
push 0xa
push 0x3703
push str.YU_OJ_
call fcn.00433314
add esp, 0xc
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x437483
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x437480
cmp dword [ebp - 0x1c], 4
sete byte [ebp - 1]
push edi
call esi
push ebx
call esi
pop edi
pop esi
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x43748e
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x46f1b0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 8
mov eax, 0x4558ea
call fcn.00444333
and dword [ebp - 0x10], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.004035f0
and dword [ebp - 4], 0
push 0x400
lea eax, [ebp]
push eax
push edi
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [ebp + eax], 0
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00402920
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0043eaba
add ebp, 0x408
leave
ret
Function at 0x4379f6
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x4575b8
call fcn.00444333
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp dword [eax - 0xc], ebx
jne 0x437a20
push 0x80070057
call dword [sym.imp.KERNEL32.DLL_SetLastError]
jmp 0x437b6a
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004347a5
pop ecx
pop ecx
push str.EnableLUA
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00402830
push 0x3f
push 0xd49
push 0x462bf8
mov byte [ebp - 4], 1
call fcn.00433314
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
call fcn.00402830
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
xor eax, eax
mov byte [ebp - 4], 2
call fcn.00432795
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x18]
seta byte [ebp - 0xe]
call fcn.004028e0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004028e0
cmp byte [ebp - 0xe], bl
je 0x437afa
push dword [esi]
lea ecx, [ebp - 0x1c]
call fcn.00402830
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
cmp byte [eax], bl
je 0x437af0
sub eax, edi
js 0x437af0
mov ecx, eax
mov eax, esi
call fcn.0040a170
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00402e60
cmp byte [ebp - 0xe], 0x49
je 0x437ad6
cmp byte [ebp - 0xe], 0x69
jne 0x437afa
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00402810
call fcn.00436660
pop ecx
mov byte [ebp - 0xd], al
jmp 0x437b62
push 0x80070057
call fcn.00401000
push 0x44
pop esi
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00442500
push 5
pop eax
push 0x10
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x44], 1
call fcn.00442500
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x437b62
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 0xd], 1
cmp dword [ebp - 0x2c], ebx
je 0x437b58
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x28], ebx
je 0x437b62
push dword [ebp - 0x28]
call esi
lea ecx, [ebp - 0x14]
call fcn.004028e0
mov al, byte [ebp - 0xd]
call fcn.004443d2
ret