joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4829a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, 0x8000
push edi
cmp eax, esi
mov dword [esp + 0x14], esi
jbe 0x4829be
mov dword [esp + 0x14], eax
mov esi, eax
push esi
call fcn.005f17db
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
mov ebp, dword [esp + 0x24]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x10], ebx
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
jne 0x4829fd
xor ebx, ebx
jmp 0x482a1a
lea eax, [esp + 0x24]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x482a16
or ebx, 0xffffffff
jmp 0x482a1a
mov ebx, dword [esp + 0x24]
push 0
push 0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x482a6d
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push 0
push ecx
push eax
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x482a52
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
je 0x482a69
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005f1804
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x2c]
cmp ebx, esi
jae 0x482a92
test ebx, ebx
je 0x482b66
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push 0
push edx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x482b66
lea ecx, [ebx + edi]
add edi, eax
push esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], edi
call fcn.005f17db
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x24], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x482ac6
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
jg 0x482b05
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x482b05
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push 0
push eax
push esi
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x482aff
or esi, 0xffffffff
jmp 0x482b07
mov esi, dword [esp + 0x28]
jmp 0x482b07
xor esi, esi
mov edx, dword [esp + 0x2c]
push 0
push 0
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test ebx, ebx
je 0x482b2f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
add edx, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x10], edx
test esi, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, esi
jg 0x482ac2
push eax
call fcn.005f1804
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call fcn.005f1804
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x482b80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
jne 0x482ba3
or ebx, eax
jmp 0x482ba5
mov ebx, eax
push 2
push 0
push 0
push esi
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
je 0x482bbf
mov dword [esp + 0x1c], eax
push 0
push ebx
push esi
call fcn.00482ec0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub eax, ebp
sub ecx, ebp
add esp, 0xc
cmp ecx, eax
mov dword [esp + 0x20], ecx
jl 0x482be7
mov dword [esp + 0x20], eax
push 0x8000
call fcn.005f17db
mov ebx, eax
add esp, 4
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [eax + ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x24]
push 0
push edx
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x482c31
or eax, 0xffffffff
jmp 0x482c6d
mov edi, dword [esp + 0x24]
mov eax, edi
test edi, edi
mov dword [esp + 0x14], eax
jle 0x482c6d
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x482c69
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x482c78
cmp dword [esp + 0x10], edi
jne 0x482c78
mov eax, dword [esp + 0x14]
add ebp, eax
cmp eax, 0x8000
jne 0x482c8b
jmp 0x482c01
push ebx
call fcn.005f1804
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
sub eax, ecx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call fcn.005f1804
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x482cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6232fb
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebx
mov ebx, dword [esp + 0xb4]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
je 0x482e64
push ebx
call fcn.00435355
add esp, 4
test eax, eax
je 0x482e64
push ebx
lea ecx, [esp + 0x18]
call fcn.005f00e0
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xb8], ebp
cmp esi, ebp
je 0x482d31
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x482e50
neg esi
sbb esi, esi
mov dword [esp + 0x18], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
and esi, 0xc0000000
add esi, 0xc0000000
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x482e04
mov eax, dword [esp + 0x18]
test eax, eax
je 0x482d67
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x695d50]
cmp eax, 0xffffffff
jne 0x482da2
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x2c]
xor eax, eax
cmp ecx, 2
sete al
mov dword [0x695d50], eax
test eax, eax
je 0x482dbb
push 0
push 0x80
push 4
push 0
push 1
push esi
push ebx
call ebp
mov edi, eax
jmp 0x482de9
push ebx
lea ecx, [esp + 0x14]
call fcn.00448c70
mov edx, dword [esp + 0x10]
push 0
push 0x80
push 4
push 0
push 1
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00449480
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 3
mov dword [esp + 0x18], eax
jl 0x482d4e
cmp edi, 0xffffffff
je 0x482e9a
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x482e1c
or ebp, eax
jmp 0x482e1e
mov ebp, eax
push 2
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
jne 0x482e30
or ebx, eax
jmp 0x482e32
mov ebx, eax
push 0
push 0
push ebp
push edi
call esi
test ebx, ebx
jne 0x482e9a
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x482e80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov dword [esp + 0xb8], 0xffffffff
call fcn.005f0020
or eax, 0xffffffff
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret
lea eax, [esp + 0x10]
push 2
push eax
push 0
push edi
mov dword [esp + 0x20], 0xfeff
call fcn.004829a0
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0xb8], 0xffffffff
call fcn.005f0020
mov eax, edi
jmp 0x482e67
Function at 0x4866d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x62373f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x68faac]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.005e6068
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.005efd95
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.005f0020
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x486b40
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x6b3714]
sub esp, 0x190
test eax, eax
je 0x486b5b
mov eax, 1
add esp, 0x190
ret
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x486b90
xor eax, eax
add esp, 0x190
ret
mov eax, 1
mov dword [0x6b3714], eax
add esp, 0x190
ret
Function at 0x496cb0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x625313
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x68faac]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x68faac]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x68faac]
mov dword [esi + 0x20], edx
mov eax, dword [0x68faac]
mov dword [esi + 0x24], eax
mov ecx, dword [0x68faac]
mov dword [esi + 0x28], ecx
mov edx, dword [0x68faac]
mov dword [esi + 0x2c], edx
mov eax, dword [0x68faac]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.005ebdf9
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.005ebdf9
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x63fe10
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.005f01a9
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x498ce0
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.00476720
test eax, eax
je 0x498cfc
mov dword [0x6b373c], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x6b373c], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x498d3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x498d59
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x498d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x498daf
jne 0x498d93
test esi, esi
jne 0x498d7d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x498d7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x498d93
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x498d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x498dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x498db3
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x498dbf
mov dword [0x6b373c], ebx
jmp 0x498dd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6b373c], eax
jmp 0x498dd6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x498de3
push edi
call ebx
test esi, esi
je 0x498dea
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x4996b0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x62568b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.005ebdf9
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x4996f4
push eax
lea ecx, [esp + 0x14]
call fcn.005ebfd5
mov eax, dword [esp + 0x660]
test eax, eax
je 0x499709
push eax
lea ecx, [esp + 0x14]
call fcn.005ebfd5
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x499788
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00510060
add esp, 0x10
test eax, eax
jne 0x499781
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.005ebe2c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x499841
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x499841
test esi, esi
je 0x499841
call fcn.00536b90
mov eax, dword [0x6b3ba0]
test eax, eax
je 0x499841
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.0050d660
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x6b3ba0]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.005ebe2c
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x49a090
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x49a0ad
cmp edi, 4
jbe 0x49a0ad
mov dword [0x6b3740], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x49a0cc
push eax
mov eax, dword [0x696498]
push eax
mov ecx, esi
call fcn.0045ebc0
cmp edi, 0xffffffff
je 0x49a0e0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.0045ebc0
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x49a0f8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.0045ebc0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x49a10e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.0045ed70
mov eax, dword [esp + 0x24]
test eax, eax
je 0x49a125
mov ecx, dword [0x6964b0]
push eax
push ecx
mov ecx, esi
call fcn.0045ed70
mov edx, dword [esp + 0x28]
test edx, edx
je 0x49a14b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x49a161
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.0045ed70
mov eax, dword [esp + 0x30]
test eax, eax
je 0x49a178
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.0045f200
mov eax, dword [esp + 0x34]
test eax, eax
je 0x49a18f
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.0045f200
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x49b130
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6258d0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x49b163
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x49b17a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.0045d960
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0045da80
test eax, eax
je 0x49b226
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.0045ff80
test eax, eax
jne 0x49b1db
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045da00
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x49b20e
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0045e0b0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.005f0159
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.005f0020
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x49b2ed
mov dword [eax], 0x10
jmp 0x49b2ed
mov edx, dword [0x68faac]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x681344
push ecx
mov byte [esp + 0x24], 2
call fcn.005e6068
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045da80
test eax, eax
jne 0x49b29a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.005f0020
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045da00
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x49b2d1
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0045e0b0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.005f0159
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.005f0020
mov eax, dword [esp + 0x20]
test eax, eax
je 0x49b2df
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.005f0020
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045da00
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49b320
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6258f8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x49b42f
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x49b42f
cmp byte [edi], bl
je 0x49b42f
cmp byte [esi], bl
je 0x49b42f
lea ecx, [esp + 0xc]
call fcn.0045d960
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x49b3cd
cmp eax, 1
je 0x49b3cd
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.0045da80
test eax, eax
jne 0x49b3bb
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.0045daf0
test eax, eax
je 0x49b41e
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0045ed70
mov esi, eax
jmp 0x49b4b2
mov edx, dword [0x68faac]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x681344
push ecx
mov byte [esp + 0x2c], 1
call fcn.005e6068
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045da80
test eax, eax
jne 0x49b443
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005f0020
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045da00
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x68faac]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.00434dc3
add esp, 8
cmp eax, ebx
je 0x49b46b
inc eax
lea ecx, [esp + 0x2c]
push eax
call fcn.005f01a9
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x49b484
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.005f0020
jmp 0x49b411
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0045ed70
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.005f0020
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005f0020
lea ecx, [esp + 0xc]
call fcn.0045dad0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045da00
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49c950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x625b5f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x63f2ec]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
mov byte [esp + 0x28], 2
cmp eax, edi
jle 0x49ca70
push ebx
push ebp
mov bl, 4
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*8]
mov edx, dword [eax + edi*8 + 4]
lea eax, [eax + edi*8]
cmp ecx, edx
ja 0x49ca62
jne 0x49c9da
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00546400
add esp, 8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.0044efa0
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
jmp 0x49ca36
mov eax, dword [eax + 4]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00546400
mov ebp, eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], bl
mov eax, dword [edx + edi*8]
push eax
push ecx
call fcn.00546400
add esp, 0x10
mov edx, dword [ebp]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x1c]
push 0x6965ec
push ecx
mov byte [esp + 0x40], 5
call fcn.00451e00
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.0044edf0
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x20]
call fcn.0044edf0
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x49ca54
push 0x6965e4
lea ecx, [esp + 0x14]
call fcn.0044fa30
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.0044fa90
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x49c99b
pop ebp
pop ebx
mov esi, dword [esp + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0044e370
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.0044edf0
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0044edf0
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4