joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cede8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4cefdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4cefc2
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4cee26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4cee46
mov eax, dword [edi + 0x34]
test eax, eax
je 0x4cee36
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4cee46
mov eax, edi
call fcn.004cf07c
jmp 0x4cefc2
cmp dword [edi + 0xa0], 0
jne 0x4cee7d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.0040b554
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f92b0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4ceeb4
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.0040b554
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f92b0]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004cf0bc
mov ebx, eax
test bl, bl
jne 0x4cef77
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4ceedd
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ceef7
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x4ceef0
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x4ceef9
xor eax, eax
test al, al
jne 0x4cef77
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x4cef0c
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x4cef23
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.0040b554
jmp 0x4cef4f
push dword [edi + 0x30]
push 0x4ceff8
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00405a70
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.0040b554
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4cef77
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004cf0bc
mov ebx, eax
test bl, bl
jne 0x4cef84
mov eax, edi
call fcn.004cf07c
jmp 0x4cefc2
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4cef93
mov dword [edi + 0xa8], eax
jmp 0x4cef9d
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.004cf134
test al, al
je 0x4cefc2
mov eax, edi
mov si, 0xffee
call fcn.0040499c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.004cf394
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cefe2
lea eax, [ebp - 0x108]
call fcn.004056dc
ret
Function at 0x4da3d8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4da54e
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
push ebx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4da568
call fcn.004059f4
mov eax, dword [ebp - 0x10]
call fcn.00405b6c
push eax
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004bdcb8
mov eax, dword [ebp - 0x14]
call fcn.00405b6c
push eax
call sub.kernel32.dll_CopyFileA
mov dl, 1
mov eax, dword [0x42add8]
call fcn.0042af54
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0042b000
mov byte [ebx + 0xc], 0
call fcn.004bd7fc
cmp al, 2
jne 0x4da47b
xor ecx, ecx
mov edx, 0x4da584
mov eax, ebx
call fcn.0042b070
jmp 0x4da489
xor ecx, ecx
mov edx, 0x4da5bc
mov eax, ebx
call fcn.0042b070
lea ecx, [ebp - 0x18]
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00443f94
mov eax, dword [ebp - 0x18]
mov edx, 0x4da5f8
call fcn.0040a104
test eax, eax
jne 0x4da4b9
lea eax, [ebp - 0xc]
mov edx, 0x4da604
call fcn.00405774
jmp 0x4da4c1
lea eax, [ebp - 0xc]
call fcn.004056dc
mov esi, dword [ebp - 4]
test esi, esi
je 0x4da4cd
sub esi, 4
mov esi, dword [esi]
lea ecx, [ebp - 0x1c]
mov edx, esi
sub edx, 4
mov eax, dword [ebp - 4]
call fcn.00443f78
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.004059a8
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov eax, ebx
call fcn.0042b6c0
mov eax, ebx
call fcn.0042afcc
mov eax, ebx
call fcn.004047a0
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x4da568
call fcn.004059f4
mov eax, dword [ebp - 0x20]
call fcn.00405b6c
push eax
call sub.gdi32.dll_AddFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_PostMessageA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da555
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405700
ret
Function at 0x4e2a68
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x4e2bad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004056dc
lea eax, [ebp - 4]
mov edx, dword [0x4f931c]
mov edx, dword [edx + 4]
call fcn.00405774
xor eax, eax
push ebp
push 0x4e2b80
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4e2b14
cmp dword [ebp - 0x8c], 1
jne 0x4e2b14
cmp dword [ebp - 0x94], 0xa
jne 0x4e2b14
lea ecx, [ebp - 0xa0]
mov edx, 0x4e2bc0
mov eax, dword [ebp - 4]
call fcn.004bdcb8
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 4]
call fcn.00405774
call fcn.00405100
jmp 0x4e2b87
call fcn.004bd7fc
sub al, 2
jb 0x4e2b23
sub al, 8
jb 0x4e2b46
jmp 0x4e2b67
lea ecx, [ebp - 0xa4]
mov edx, 0x4e2bd0
mov eax, dword [ebp - 4]
call fcn.004bdcb8
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 4]
call fcn.00405774
jmp 0x4e2b67
lea ecx, [ebp - 0xa8]
mov edx, 0x4e2be0
mov eax, dword [ebp - 4]
call fcn.004bdcb8
mov edx, dword [ebp - 0xa8]
lea eax, [ebp - 4]
call fcn.00405774
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2b87
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405730
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2bb4
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 4]
call fcn.004056dc
ret

Function at 0x4e3060
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e30cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004bdcb8
mov eax, dword [ebp - 0xc]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e30d4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4e30dc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4e31b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004bdcb8
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
je 0x4e3196
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00405b6c
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x4e315f
xor ebx, ebx
jmp 0x4e3165
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
jne 0x4e3196
push 0
push 0x4e31c8
push dword [ebp - 0xc]
push 0x4e31d8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405a70
mov eax, dword [ebp - 0x10]
movzx ecx, word [0x4e31f4]
mov dl, 1
call fcn.00448a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e31b8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405700
ret
Function at 0x4e72f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e7451
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
mov word [ebp - 0x10], 0
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004ded14
call fcn.004bd7fc
sub al, 2
jae 0x4e7379
push 0xff
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x25c]
mov ecx, pe_nt_image_headers32
call fcn.0040594c
mov eax, dword [ebp - 0x260]
mov ecx, 0xff
xor edx, edx
call fcn.00405bd4
lea eax, [ebx + 0x3cc]
mov edx, dword [ebp - 0xc]
call fcn.00405730
lea ecx, [ebp - 4]
mov edx, 0x4e7468
mov eax, dword [ebp - 0xc]
call fcn.004bdcb8
mov eax, dword [ebp - 4]
call fcn.0040af30
test al, al
je 0x4e73fc
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x15c]
call fcn.0040384c
mov edx, 2
lea eax, [ebp - 0x15c]
call fcn.00403efc
call fcn.004031e8
test eax, eax
jne 0x4e73f1
lea edx, [ebp - 0xe]
lea eax, [ebp - 0x15c]
call fcn.00403bd8
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x15c]
call fcn.00403bd8
lea eax, [ebp - 0x15c]
call fcn.00403914
call fcn.004031e8
movsx ebx, word [ebp - 0x10]
jmp 0x4e742b
mov word [ebp - 0x10], 1
mov esi, 0x1b
mov ebx, dword [0x4f3388]
call fcn.004bf1e8
movzx edx, byte [ebx]
cmp eax, edx
jne 0x4e7421
movzx eax, word [ebx + 2]
mov word [ebp - 0x10], ax
add ebx, 0xc
dec esi
jne 0x4e740d
movsx ebx, word [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7458
lea eax, [ebp - 0x260]
call fcn.004056dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4ec060
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
mov eax, dword [ebp - 8]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ec1e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
mov edx, 0x4ec200
mov eax, dword [ebp - 4]
call fcn.004bdcb8
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
jne 0x4ec0e1
lea eax, [ebp - 0x68]
call fcn.0040b454
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0xc]
mov edx, 0x4ec200
call fcn.004bdcb8
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
jne 0x4ec0e1
mov dword [ebp - 0x10], 0x20000004
cmp dword [ebp - 0x10], 0
jne 0x4ec1bf
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403b3c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0xa
mov eax, dword [ebp - 0xc]
call fcn.0040af30
test al, al
je 0x4ec1bf
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000020
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0x4ec214
push 0x4ec220
push dword [ebp - 8]
push 0x4ec220
lea eax, [ebp - 0x6c]
mov edx, 5
call fcn.00405a70
mov eax, dword [ebp - 0x6c]
call fcn.00405b6c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4ec1bf
xor eax, eax
push ebp
push 0x4ec1b8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec1bf
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec1ee
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.00405700
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405700
ret
Function at 0x4ec224
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
mov edx, 0x4ec338
call fcn.00405730
mov eax, esi
call fcn.0040af30
test al, al
je 0x4ec327
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00405b6c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4ec327
mov eax, ebx
call fcn.00402ef8
mov dword [ebp - 0xc], eax
push ebp
push 0x4ec320
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ec30a
mov eax, dword [ebp - 0xc]
mov esi, eax
mov edx, ebx
sub edx, 0x34
test edx, edx
jle 0x4ec2b6
mov esi, eax
cmp dword [esi], 0xfeef04bd
je 0x4ec2b6
inc eax
dec edx
jne 0x4ec2a8
cmp dword [esi], 0xfeef04bd
jne 0x4ec30a
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 8]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, word [esi + 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [esi + 0xc]
shr eax, 0x10
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x4ec34c
call fcn.0040bbec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec327
mov eax, dword [ebp - 0xc]
call fcn.00402f14
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ecda4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ecf62
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 8]
mov eax, 0x4ecf7c
call fcn.004bdc24
mov eax, dword [ebp - 8]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
push 0x4ecf88
push dword [ebp - 4]
push 0x4ecfa4
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405a70
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.004ec060
mov eax, dword [ebp - 8]
call fcn.0040af30
test al, al
je 0x4ecf3a
mov eax, dword [ebp - 8]
call fcn.004bde50
mov ebx, eax
lea esi, [ebx + 2]
mov eax, esi
call fcn.00402ef8
mov dword [ebp - 0x18], eax
mov edx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
call fcn.00403b3c
push 0x40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x419d88]
call fcn.0041ed94
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4ecf33
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x419b88]
call fcn.00404770
mov esi, eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.00406900
mov edx, dword [ebp - 0x24]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4ecee7
inc ebx
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x1c]
dec ebx
jne 0x4ecec7
mov eax, esi
call fcn.004047a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecf3a
mov eax, dword [ebp - 0x14]
call fcn.004047a0
mov eax, dword [ebp - 0x18]
call fcn.00402f14
mov eax, dword [0x4f36e0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 8]
call fcn.00405b6c
push eax
call sub.kernel32.dll_DeleteFileA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ecf69
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405700
ret
Function at 0x4ed030
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405b5c
xor eax, eax
push ebp
push 0x4ed1aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 1
xor edx, edx
mov eax, 0xf
call fcn.004a70ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ed184
xor eax, eax
push ebp
push 0x4ed17d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.004a70cc
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4ed157
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040a1fc
mov eax, dword [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040594c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040a1fc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405b04
jne 0x4ed143
mov ecx, dword [ebp - 0x12c]
xor edx, edx
mov eax, 1
call fcn.004ed1bc
mov esi, eax
test esi, esi
jne 0x4ed129
mov dword [ebp - 8], 5
call fcn.00405100
jmp 0x4ed184
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x4ed13d
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
push esi
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.004a70ec
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ed0b9
mov dword [ebp - 8], 0x7f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed184
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed1b1
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00405700
lea eax, [ebp - 4]
call fcn.004056dc
ret
Function at 0x4ed1bc
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x4ed325
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 5
jne 0x4ed325
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
not eax
cmp eax, 2
jne 0x4ed221
mov ebx, 5
jmp 0x4ed325
mov dword [ebp - 8], 0x10
lea eax, [ebp - 0xc]
push eax
push 0
push 0x28
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4ed26b
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0x3f0
jne 0x4ed325
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4ed325
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa4], 2
lea eax, [ebp - 0xac]
push eax
push 0x4ed330
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc0]
push eax
push 0x10
lea eax, [ebp - 0xb0]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
jne 0x4ed2c7
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4ed325
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x514
jne 0x4ed2e5
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4ed325
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.kernel32.dll_OpenProcess
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
lea eax, [ebp - 0xc0]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
jne 0x4ed325
push 5
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ed578
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [ebx + 8], 0
je 0x4ed669
mov dword [ebp - 4], 4
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4ed5c0
call sub.kernel32.dll_GetLastError_1
mov cl, 1
mov edx, eax
mov eax, ebx
call fcn.004ed434
jmp 0x4ed669
push 0xf01ff
mov eax, dword [ebx + 4]
call fcn.00405b6c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4ed5f2
call sub.kernel32.dll_GetLastError_1
mov cl, 2
mov edx, eax
mov eax, ebx
call fcn.004ed434
jmp 0x4ed669
xor eax, eax
push ebp
push 0x4ed662
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4ed618
call fcn.00405100
jmp 0x4ed669
mov eax, dword [0x4f36e0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed669
mov eax, dword [0x4f36e0]
mov eax, dword [eax]
call fcn.00476ef4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4f36e0]
mov eax, dword [eax]
call fcn.00476ef4
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ed674
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20]
push ecx
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 4], ecx
mov edi, edx
xor esi, esi
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ed6b8
inc esi
movzx eax, si
imul eax, eax, 0x64
push eax
call sub.kernel32.dll_Sleep_1
test bl, bl
jne 0x4ed6c2
cmp si, 0x14
jbe 0x4ed693
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4