joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b65b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41b707
lea eax, [ebp + 0x34]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41b6b2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41b6a6
push 0x23ec
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x41b6b0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x41b702
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41b6dd
mov byte [ebp - 1], 0
push 0x1b1a
push 1
push 0
lea eax, [ebp - 1]
push eax
call fcn.00428170
add esp, 0x10
jmp 0x41b702
mov byte [ebp - 2], 0
push 0x3abc
push 0x14cf
push 1
push 0
lea eax, [ebp - 2]
push eax
push 0x1327
push 1
call fcn.00408653
add esp, 0x1c
jmp 0x41b816
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41b7d5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41b793
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41b791
push 0x753c
push 0xc45
push 0
call fcn.004286ab
add esp, 0xc
jmp 0x41b7d3
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x41b7d3
push 0x79e5
push 0x2b65
push 0
push 0
push 0x3e05
push 0x662
push 0x1a6f
push 0x3ec1
call fcn.004121ba
add esp, 0x20
jmp 0x41b816
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
push dword [ebp - 0x5c]
push 0x6a7c
push dword [ebp - 0x60]
push 0x3ba7
push dword [ebp - 0x64]
push 0
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call fcn.004150d3
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x426c0f
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x426d12
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x426cd2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x426c85
push 0x171b
push 0x1dd5
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x426cd0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x426cb3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x426cd0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0043532a
mov dword [eax], 0x2c51978e
jmp 0x426ca8
jmp 0x426d0d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x23c5
push dword [ebp - 0x48]
push 0x7942
push 0
push 0x1c6f
push 1
push 0x1b71
call fcn.00422630
add esp, 0x24
jmp 0x426da7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x426d75
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x426d69
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x426d73
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x426da7
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
push 0x449a
push 0x47fc
push 0x157f
push 0
push 0x4fbd
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0
call fcn.0040e33a
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x42e5a9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42e5e5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 1
call fcn.0042e755
add esp, 0x10
jmp 0x42e751
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42e724
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42e71a
push 1
lea ecx, [ebp - 0x4c]
call fcn.0043523c
mov dword [ebp - 0x24], 0x60b4ffb8
mov dword [ebp - 0x20], 0x20452a26
mov dword [ebp - 0x6c], 0x6d8bc0d
mov dword [ebp - 0x68], 0x6d8bc0d
mov dword [ebp - 0x64], 0x6d8bc0d
mov dword [ebp - 0x60], 0x6d8bc0d
lea ecx, [ebp - 1]
call fcn.00435339
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043533c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x58]
call fcn.004352e8
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x436
push 0x279e
push 0x66d2
push 0x4eec
push 0x601
push 0x847
push 0
call fcn.00422913
add esp, 0x28
push 0x40b3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push 1
push 0x2376
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x45c8
push 0
call fcn.0041f642
add esp, 0x2c
push 0x26cc
push 0x56b8
push 1
push 0x43ce
push 0x2fd8
push 1
push 1
push 1
push 0x5a63
push 0x3e11
call fcn.00412600
add esp, 0x28
lea ecx, [ebp - 0x58]
call fcn.0043530e
lea ecx, [ebp - 0x4c]
call fcn.0043530e
jmp 0x42e722
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x42e751
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x30]
push 0
push 0x5b3a
push dword [ebp - 0x34]
push 0x1766
push 0x2de6
call fcn.00416bb7
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x43ee3a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43ef2e
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43eee6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43eea3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43eee4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43eee4
push 0x2228
push 0x1fbc
push 0x1caa
push 0x2056
push 0x1f5a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x43ef2c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43ef15
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x43ef2c
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43ef2c
push 0x23ec
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x43ef76
push 0
push 0x73a2
push 0x765f
push 0x7bdf
push 0x51d1
push 0x163d
push 0x50d6
push 0x23a
push 0x7b05
push 0x5e5d
push 0x2235
push 0x6fc2
push 1
push 0x2a8f
call fcn.0043e997
add esp, 0x38
mov esp, ebp
pop ebp
ret
Function at 0x441922
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x441946
push 0x2b91
push 1
push 1
call fcn.00441a07
add esp, 0xc
jmp 0x441a03
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4419a1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.00448bd9
add esp, 0x10
jmp 0x441a03
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4419e5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4419e3
push 0
push 1
push 1
push 0
call fcn.00459cf1
add esp, 0x10
jmp 0x441a03
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x441a03
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x442bb9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x442cb9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x442c73
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x442c5a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x442c3b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x442c58
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.0043532a
mov dword [eax], 0xfffffffd
jmp 0x442c30
jmp 0x442c71
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x442c71
push 0x23ec
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x442cb7
push 1
push 0x6be5
push 0x3f80
push 0x5d94
push 0x1c84
push 0x5180
push 0x49d9
push 1
push 1
push 0
push 0x1cd0
push 0x1d24
push 0x2559
push 0x5a
push 0x5a2e
call fcn.0043d923
add esp, 0x3c
jmp 0x442cd8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
push 0x6bba
push 0x4dd7
push 1
push dword [ebp - 0x34]
push 0
call fcn.004417fe
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x442fef
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44311c
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44308c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44307f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44307d
push 0x76a
push 0x268e
push 0x402c
push 0
push 0x529a
push 1
push 0
push 1
push 0x47c3
push 0xe55
push 0x3da2
push 0x3f7e
call fcn.00445736
add esp, 0x30
jmp 0x443087
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x44311a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4430f5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4430d6
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x4430f3
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.0043532a
mov dword [eax], 0xfffffffe
jmp 0x4430cb
jmp 0x44311a
push 0x1fe4
push 0
push 0x1c16
push 0x248a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x443154
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x3c]
push 0x6bbb
push dword [ebp - 0x40]
push 0x585a
push 0
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.0044a3df
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4476fb
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4477c8
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x447754
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
push 0x2b2e
push 0x240
call fcn.004477ed
add esp, 0x10
jmp 0x4477c6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44777e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x4477c6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4477ac
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x4477c6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.0043532a
and dword [eax], 0
jmp 0x4477a1
jmp 0x4477e9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x228e
call fcn.0043c1a6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x448ad8
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x448ba7
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448b9a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x448b78
mov byte [ebp - 1], 0
push 0xde4
push 0x5957
push 1
push 1
push 0x4f6e
lea eax, [ebp - 1]
push eax
push 0x3076
push 0x44
push 0x7a42
push 0x1799
push 0x208e
push 0x6e3f
push 0x1726
push 0x2b8b
push 0
push 0xf02
push 0x621a
push 1
call fcn.004532bc
add esp, 0x48
jmp 0x448b98
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x448b98
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x448ba5
push 0
push 1
call fcn.004403eb
pop ecx
pop ecx
jmp 0x448bd5
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 1
push 0x66a4
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0043fd88
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x44b246
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44b31f
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44b302
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44b2f8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x44b2b0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x44b2f6
mov byte [ebp - 1], 0
push 0x46e4
push 0x31b2
push 1
lea eax, [ebp - 1]
push eax
push 0
push 1
push 1
call fcn.00448ad8
add esp, 0x1c
push 1
push 0
push 0x7577
push 1
push 0x6d81
push 1
call fcn.0043ee3a
add esp, 0x18
jmp 0x44b2a5
jmp 0x44b300
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x44b31d
push 0
push 0x216e
push 0
push 0x2974
push 0x3cfa
call fcn.00441e7d
add esp, 0x14
jmp 0x44b348
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0043ea30
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44eeea
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x44efae
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44ef84
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44ef6a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44ef68
push 0x5a26
push 0x5b80
push 1
push 1
push 1
call fcn.0043fcb1
add esp, 0x14
jmp 0x44ef82
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44ef82
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x44efac
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push 0x4d5c
push 0x29fe
push dword [ebp - 0x2c]
push 1
push 1
push dword [ebp - 0x30]
call fcn.00445233
add esp, 0x18
jmp 0x44efd1
push 0x7a27
push 0x726
push 0x1a0c
push 0
push 0x4efc
push 0x207d
call fcn.0044aaf4
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4577a9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x457886
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45784a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x457832
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x457830
push 0
push 0x93e
push 0x1c9b
push 1
push 0x712
push 0x440
push 1
push 0x4a48
call fcn.0043fa66
add esp, 0x20
jmp 0x457848
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x457848
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x457884
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x5552
push 0x4f9f
push 0x28cc
push 0x6522
push 0x1d2a
push 1
push 1
push 0x854
push 0
push 0x4754
push dword [ebp - 0x28]
call fcn.00457951
add esp, 0x2c
jmp 0x457898
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x2c]
call fcn.00439e79
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret