joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f98c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46f9a3
add esp, 0xfffffff0
call fcn.004038c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00426b40
mov eax, dword [0x516dec]
cmp word [eax + 2], 0
jne 0x46f9cb
mov eax, dword [0x516dec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047110c
mov eax, dword [0x517038]
cmp word [eax + 2], 0
jne 0x46f9e5
mov eax, dword [0x517038]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00471304
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41ab1c]
call fcn.00403530
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41ab1c]
call fcn.00403530
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x42972c]
call fcn.00430fcc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x46fb6c
mov eax, dword [0x516ad8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043139c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4718a4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x516ad8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e104
test eax, eax
je 0x46fada
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409b00
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e12c
test eax, eax
je 0x46faee
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004046e4
mov eax, dword [0x516710]
cmp byte [eax], 0
jne 0x46fb22
mov eax, ebx
call fcn.0046fc94
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00471a80
mov eax, ebx
call fcn.00472444
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46fb62
call fcn.0040391c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ff14
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x518c10]
cmp dword [eax + 0x30], 0
je 0x46ffbe
cmp dword [ebx + 0x94], 0
jne 0x46ffb8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46fea4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46ffb8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46ff7e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46ffb8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d640
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46ff8d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x470b20
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x470b55
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404564
jmp 0x470b62
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044c8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x471c5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x471c9d
mov eax, esi
call fcn.00457834
test al, al
je 0x471c9d
mov eax, dword [ebx + 0x84]
call fcn.00457530
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x471c9d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00457530
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x475414
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x475442
mov eax, ebx
call fcn.00475ec8
cmp dword [ebx + 0x40], 0
je 0x47543b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4754b3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4754a5
cmp dword [ebx + 8], 0
je 0x475464
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x475476
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4754a5
cmp dword [ebx + 8], 0
je 0x475457
cmp eax, 3
je 0x475489
dec eax
jne 0x475457
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x475457
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x475457
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4754d1
cmp dword [ebx + 0x14], 0xcc
je 0x4754d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004754dc
pop ebx
ret
Function at 0x48a09c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48a156
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x10]
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x20]
mov dl, byte [ebx + 0x30]
mov byte [eax], dl
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
sub esi, eax
test esi, esi
je 0x48a0db
mov edx, dword [ebx + 0x10]
mov ecx, esi
call fcn.004029c4
add esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 4]
mov esi, dword [eax]
call dword [esi + 0xc]
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x1c], eax
mov esi, dword [ebx + 0x14]
mov dword [ebx + 0x20], esi
cmp esi, dword [ebx + 0x18]
jne 0x48a132
mov edx, esi
dec edx
mov eax, dword [ebx + 0x10]
call fcn.0041d4a4
mov edi, eax
mov dword [ebx + 0x20], edi
cmp edi, dword [ebx + 0x10]
jne 0x48a132
lea edx, [ebp - 4]
mov eax, dword [0x516e70]
call fcn.0040668c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00489f4c
mov eax, dword [ebx + 0x20]
mov al, byte [eax]
mov byte [ebx + 0x30], al
mov eax, dword [ebx + 0x20]
mov byte [eax], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a15d
lea eax, [ebp - 4]
call fcn.00404474
ret

Function at 0x48aaf8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 5
jb 0x48ab3d
cmp dword [ebp - 0x8c], 0
jbe 0x48ab34
mov byte [0x514aa8], 8
jmp 0x48abb1
mov byte [0x514aa8], 7
jmp 0x48abb1
cmp eax, 3
jbe 0x48abb1
cmp dword [ebp - 0x84], 2
jne 0x48ab54
mov byte [0x514aa8], 1
jmp 0x48abb1
and dword [ebp - 0x88], 0xffff
mov eax, dword [ebp - 0x8c]
cmp eax, 0x5a
jb 0x48ab72
mov byte [0x514aa8], 6
jmp 0x48abb1
cmp eax, 0xa
jb 0x48ab95
cmp dword [ebp - 0x88], 0x8ae
jb 0x48ab8c
mov byte [0x514aa8], 5
jmp 0x48abb1
mov byte [0x514aa8], 4
jmp 0x48abb1
cmp dword [ebp - 0x88], 0x3e8
jb 0x48abaa
mov byte [0x514aa8], 3
jmp 0x48abb1
mov byte [0x514aa8], 2
mov esp, ebp
pop ebp
ret
Function at 0x4b1490
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b1498
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b168a
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b16a0
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004044c8
lea ecx, [ebp - 0x10]
mov edx, 0x4b16b4
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004044c8
lea ecx, [ebp - 0x14]
mov edx, 0x4b16cc
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004044c8
lea ecx, [ebp - 0x18]
mov edx, 0x4b16e8
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004044c8
lea ecx, [ebp - 0x1c]
mov edx, 0x4b1704
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004044c8
lea ecx, [ebp - 0x24]
mov edx, 0x4b171c
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408c80
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004091c8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b1734
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x28]
call fcn.004a1968
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b1744
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x2c]
call fcn.004a1968
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b175c
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004091c8
inc eax
je 0x4b162d
lea ecx, [ebp - 0x34]
mov edx, 0x4b175c
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x34]
call fcn.0040918c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aff8
fstp qword [ebp - 0x3c]
wait
call fcn.0040b35c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b1648
lea ecx, [ebp - 0x40]
mov edx, 0x4b175c
mov eax, esi
call fcn.004a49c4
mov eax, dword [ebp - 0x40]
call fcn.004a1968
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b176c
mov eax, esi
call fcn.004a49c4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004044c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1691
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404498
ret
Function at 0x4be38c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4be45a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bec18
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404934
push eax
push 0x4be468
mov eax, dword [0x516fb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
test ebx, ebx
jns 0x4be3e1
call fcn.00403498
test ebx, ebx
je 0x4be432
cmp ebx, 0x20
jg 0x4be432
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00409050
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x51744c]
call fcn.0040668c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.0040a1e8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d1a0
call fcn.00403df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be461
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404498
ret

Function at 0x4be470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4be545
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bec18
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404934
push eax
mov eax, dword [ebx + 0x60]
call fcn.00404934
push eax
push 0x4be554
mov eax, dword [0x516fb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4be4ca
call fcn.00403498
mov ebx, eax
test ebx, ebx
je 0x4be51d
cmp ebx, 0x20
jg 0x4be51d
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00409050
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x51744c]
call fcn.0040668c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.0040a1e8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d1a0
call fcn.00403df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be54c
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404498
ret
Function at 0x4be55c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4be631
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bec18
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404934
push eax
mov eax, dword [ebx + 0x68]
call fcn.00404934
push eax
push 0x4be640
mov eax, dword [0x516fb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4be5b6
call fcn.00403498
mov ebx, eax
test ebx, ebx
je 0x4be609
cmp ebx, 0x20
jg 0x4be609
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00409050
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x51744c]
call fcn.0040668c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.0040a1e8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d1a0
call fcn.00403df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be638
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404498
ret

Function at 0x4be648
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4be71d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bec18
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404934
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00404934
push eax
push 0x4be72c
mov eax, dword [0x516fb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4be6a2
call fcn.00403498
mov ebx, eax
test ebx, ebx
je 0x4be6f5
cmp ebx, 0x20
jg 0x4be6f5
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00409050
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x51744c]
call fcn.0040668c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.0040a1e8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d1a0
call fcn.00403df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be724
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404498
ret
Function at 0x4be734
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4be809
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bec18
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404934
push eax
mov eax, dword [ebx + 0x64]
call fcn.00404934
push eax
push 0x4be818
mov eax, dword [0x516fb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
test eax, eax
jns 0x4be78e
call fcn.00403498
mov ebx, eax
test ebx, ebx
je 0x4be7e1
cmp ebx, 0x20
jg 0x4be7e1
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00409050
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x51744c]
call fcn.0040668c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.0040a1e8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d1a0
call fcn.00403df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be810
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404498
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404498
ret

Function at 0x4c20f8
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404924
xor eax, eax
push ebp
push 0x4c2176
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404934
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4c2141
mov eax, dword [ebx + 4]
call fcn.00404934
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c217d
lea eax, [ebp - 4]
call fcn.00404474
ret
Function at 0x4c3178
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c3315
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b50
cmp word [ebx + 0xa2], 0
je 0x4c31c1
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c31d5
lea esi, [ebp - 8]
jmp 0x4c31d7
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4c31e4
xor edi, edi
jmp 0x4c31f1
mov eax, dword [ebx + 0x80]
call fcn.00404934
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404934
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004c28b0
mov eax, dword [ebp - 0x14]
call fcn.00404934
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404934
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404934
push eax
mov eax, ebx
call fcn.004c29e4
push eax
mov eax, ebx
call fcn.004c29b8
push eax
mov eax, ebx
call fcn.004c296c
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004c277c
mov eax, dword [ebp - 0x18]
call fcn.00404934
push eax
mov eax, dword [ebx + 8]
call fcn.00404934
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4c327a
call fcn.0040e9c0
xor edx, edx
push ebp
push 0x4c32f3
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4c32b8
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4c32ae
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c32dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c32fa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4c3324
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4c3350
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404934
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c3375
call fcn.0040e9c0
xor eax, eax
push ebp
push 0x4c33ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4c3395
call fcn.0040e9c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c33b3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4e81cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x51620a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4e8223
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x51622b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4e8219
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4e8227
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4f7448
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f75c9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5164ac], 0
jne 0x4f75a6
push 0x519104
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x4f759f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5164ac], 0
jne 0x4f7587
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ac0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404934
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00408954
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4f75e0
call fcn.0040a1e8
mov eax, dword [ebp - 0xc]
call fcn.00404934
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4f7508
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404ac0
jmp 0x4f753f
lea eax, [ebp - 8]
mov edx, 0x4f7600
call fcn.0040450c
xor eax, eax
push ebp
push 0x4f7535
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004b7168
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f753f
mov eax, dword [ebp - 8]
call fcn.00404934
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5164ac], eax
cmp dword [0x5164ac], 0
jne 0x4f7572
mov ecx, dword [0x516d74]
mov dl, 1
mov eax, dword [0x407cd8]
call fcn.0040d25c
call fcn.00403df0
push 0x4f760c
mov eax, dword [0x5164ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x51911c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f75a6
push 0x519104
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f75d0
lea eax, [ebp - 0x18]
call fcn.00404474
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404498
ret