joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454e3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48fbe0]
cmp dword [eax + 0x30], 0
je 0x454ee6
cmp dword [ebx + 0x94], 0
jne 0x454ee0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x454dcc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454ee0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x454ea6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454ee0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004153b0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x454eb5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455a48
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455a7d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a2c
jmp 0x455a8a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404990
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x456af4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456b35
mov eax, esi
call fcn.0043d31c
test al, al
je 0x456b35
mov eax, dword [ebx + 0x84]
call fcn.0043d018
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456b35
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d018
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4574a4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push ebp
push 0x45752d
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x45750d
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045745c
mov ebx, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404b34
mov eax, dword [ebp - 8]
call fcn.00404bfc
push eax
push esi
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
push ebx
call fcn.00406cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x457517
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457534
lea eax, [ebp - 8]
call fcn.0040493c
ret
Function at 0x457584
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
call fcn.00457488
mov ebx, eax
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4575e3
mov eax, esi
lea edx, [ebp - 0x10c]
mov ecx, 0x100
call fcn.00404bac
push ebx
call fcn.00406cc8
jmp 0x4575f0
mov eax, esi
call fcn.0040493c
push ebx
call fcn.00406cc8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4576d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
cmp edx, dword [ebp + 8]
jne 0x4576f1
mov esi, eax
mov eax, edx
test eax, eax
jbe 0x4576ed
mov dl, byte [esi]
xor dl, 8
mov byte [ecx], dl
inc esi
inc ecx
dec eax
jne 0x4576e1
mov al, 1
jmp 0x4576f3
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4576f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
cmp edx, dword [ebp + 8]
jne 0x457719
mov esi, eax
mov eax, edx
test eax, eax
jbe 0x457715
mov dl, byte [esi]
xor dl, 8
mov byte [ecx], dl
inc esi
inc ecx
dec eax
jne 0x457709
mov al, 1
jmp 0x45771b
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4579d0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x48cf4c]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x457ccc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x457ce5
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x457cde
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x457cf7
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x457cf0
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004578c0
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x457d11
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004579d0
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x457d96
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x457db3
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00457950
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x457ddc
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457df4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x457e0d
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x457e06
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x457e21
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004577b8
test bl, bl
jne 0x457ef4
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x48fc08
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x457e58
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x457e6c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00457ccc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x457e9e
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x457e4d
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x457ec1
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x457ed2
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x457ee6
jmp 0x457faf
cmp bl, 1
jne 0x457faf
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x48fc62
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x457f14
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x457f28
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00457ccc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x457f5a
sub ebx, 6
inc dword [ebp - 8]
jne 0x457f09
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x457f81
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x457f92
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x457fa6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0045783c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x459348
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
mov eax, dword [ebp - 8]
call fcn.00404dec
xor eax, eax
push ebp
push 0x4593e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
call fcn.004573e4
mov ebx, eax
test ebx, ebx
jbe 0x4593c7
push 4
mov eax, dword [ebp - 8]
call fcn.00404dfc
push eax
push ebx
call fcn.004573ec
mov edi, eax
test edi, edi
jbe 0x4593bd
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4593b7
mov esi, dword [ebp - 0x20]
push edi
call fcn.004573b4
push ebx
call fcn.004573b4
mov ebx, esi
jmp 0x4593cc
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4593ee
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404960
ret

Function at 0x459460
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
mov eax, dword [ebp - 8]
call fcn.00404dec
xor eax, eax
push ebp
push 0x459539
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
call fcn.004573e4
mov ebx, eax
test ebx, ebx
jbe 0x459517
push 0x14
mov eax, dword [ebp - 8]
call fcn.00404dfc
push eax
push ebx
call fcn.004573ec
mov esi, eax
test esi, esi
jbe 0x459511
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call fcn.0045741c
test eax, eax
je 0x45950b
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x45950b
jmp 0x459505
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040e100
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x45950b
cmp edi, dword [ebp - 0x14]
ja 0x45950b
cmp dword [ebp - 0x24], 4
jne 0x4594e6
push esi
call fcn.004573b4
push ebx
call fcn.004573b4
cmp dword [ebp - 0x24], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459540
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404960
ret
Function at 0x45954c
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
mov eax, dword [ebp - 8]
call fcn.00404dec
xor eax, eax
push ebp
push 0x45961b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
call fcn.004573e4
mov ebx, eax
test ebx, ebx
jbe 0x4595f9
push 0x24
mov eax, dword [ebp - 8]
call fcn.00404dfc
push eax
push ebx
call fcn.004573ec
mov esi, eax
test esi, esi
jbe 0x4595f3
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4595ed
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4595ed
jmp 0x4595e7
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040e100
lea eax, [ebp - 0x24]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4595ed
cmp edi, dword [ebp - 0x10]
ja 0x4595ed
cmp dword [ebp - 0x20], 1
jne 0x4595c8
push esi
call fcn.004573b4
push ebx
call fcn.004573b4
cmp dword [ebp - 0x20], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459622
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404960
ret
Function at 0x45962c
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404dec
mov eax, dword [ebp + 8]
call fcn.00404dec
xor eax, eax
push ebp
push 0x45981c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4597df
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0x459830
call fcn.004573e4
mov ebx, eax
test ebx, ebx
jne 0x4596bc
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x1c]
call fcn.0040c2e4
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x407f28]
call fcn.0040cb10
call fcn.004042d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4597e9
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
push 0
push 2
push 0x110
push 0xf01ff
push edi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45971c
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x20]
call fcn.0040c2e4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x407f28]
call fcn.0040cb10
call fcn.004042d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4597e9
mov byte [ebp - 5], 1
mov eax, dword [0x48e580]
cmp dword [eax], 0
je 0x4597b8
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.00404e5c
mov eax, 4
call fcn.00402764
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00404bfc
inc eax
call fcn.00402764
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
push ebp
push 0x4597b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00409ab4
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x48e580]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4597b8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00402784
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0045741c
mov eax, dword [ebp - 0xc]
push eax
call fcn.004573b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4597e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459823
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404960
lea eax, [ebp - 0x14]
call fcn.0040493c
lea eax, [ebp - 4]
call fcn.0040493c
lea eax, [ebp + 8]
call fcn.0040493c
ret
Function at 0x459834
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
xor eax, eax
push ebp
push 0x459911
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4598f1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0x459924
call fcn.004573e4
mov ebx, eax
test ebx, ebx
je 0x4598e7
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
push ebx
call fcn.004573ec
mov esi, eax
test esi, esi
je 0x4598e1
mov eax, dword [ebp - 8]
sub eax, 1
jb 0x4598a7
je 0x4598ae
dec eax
je 0x4598b5
jmp 0x4598ba
mov edi, 2
jmp 0x4598ba
mov edi, 3
jmp 0x4598ba
mov edi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
je 0x4598db
mov byte [ebp - 9], 1
push esi
call fcn.004573b4
push ebx
call fcn.004573b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4598fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459918
lea eax, [ebp - 4]
call fcn.0040493c
ret

Function at 0x459928
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404dec
xor eax, eax
push ebp
push 0x459a58
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call fcn.004573e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459a42
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404dfc
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004573ec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459a39
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x14]
call fcn.00408b70
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x459a29
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
sub eax, 2
je 0x4599db
dec eax
je 0x4599e9
dec eax
je 0x4599f7
jmp 0x459a05
mov eax, ebx
mov edx, 0x459a6c
call fcn.00404990
jmp 0x459a11
mov eax, ebx
mov edx, 0x459a78
call fcn.00404990
jmp 0x459a11
mov eax, ebx
mov edx, 0x459a84
call fcn.00404990
jmp 0x459a11
mov eax, ebx
mov edx, 0x459a90
call fcn.00404990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a30
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
mov eax, dword [ebp - 8]
push eax
call fcn.004573b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a5f
lea eax, [ebp - 4]
call fcn.0040493c
ret
Function at 0x45adb4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x45ae3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48fd80
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x45ae27
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c2e4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x45ae54
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x48e49c]
mov dl, 1
mov eax, dword [0x459d20]
call fcn.0040cc08
call fcn.004042d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ae44
lea eax, [ebp - 0x1c]
call fcn.0040493c
ret

Function at 0x45b508
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0045b42c
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403d48
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x45b56c
call fcn.0045acb8
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x45b55e
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403d48
pop esi
pop ebx
ret

Function at 0x45b590
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045b2b0
xor eax, eax
push ebp
push 0x45b60f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040493c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x45b5c9
call fcn.00404384
jmp 0x45b616
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x45b5f9
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b616
mov eax, dword [ebp - 4]
call fcn.0045b2bc
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45b61c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045b2b0
xor eax, eax
push ebp
push 0x45b695
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040493c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x45b658
call fcn.00404384
jmp 0x45b69c
push 0x100
lea eax, [ebp - 0x104]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x45b67f
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, 0x100
call fcn.00404bac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b69c
mov eax, dword [ebp - 4]
call fcn.0045b2bc
ret
pop ebx
mov esp, ebp
pop ebp
ret