joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439f06
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x439fa4
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x439f54
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x6030
push dword [ebp - 0xc]
push 1
call fcn.00439fb0
add esp, 0xc
jmp 0x439fa2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x439f7d
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x439fa2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x439fa2
push 0
push 0x2529
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x439fac
push 0
call fcn.00437678
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43a36e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43a42e
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43a421
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43a3d5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43a3d3
push 0x4128
push 0
push 0x3381
push 1
push 0x2dac
push 0
call fcn.00442156
add esp, 0x18
jmp 0x43a41f
push 0x2406
push 0x3da
push 0
push 0
push 0x5d0
push 0x1940
push 0x1e47
push 0x1c5d
push 0x26ee
push 0x1b52
push 0x13d2
push 0x548
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
jmp 0x43a429
push 0
call fcn.004475b5
pop ecx
jmp 0x43a4e2
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43a4cd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43a4a9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43a4a7
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5db
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x43a4cb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x43a4e2
push 1
push 0xbac
push 0
push 1
push 1
call fcn.00449d04
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43b37a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43b3b9
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x10f6
push 0x1f14
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
push 1
call fcn.0043b44e
add esp, 0x18
jmp 0x43b44a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43b42a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43b417
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43b415
push 0
push 0x2190
push 0x7a9c
call fcn.00443043
add esp, 0xc
jmp 0x43b428
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x43b44a
push 0
push 0x4404
push 1
push 0x1a9b
push 0x5cd0
push 0x294f
call fcn.0044af7f
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x43c4ee
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43c5c0
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43c57d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43c564
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43c562
push 0
call fcn.0043d0bc
pop ecx
jmp 0x43c57b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43c5be
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43c5b4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43c5b2
push 0x1b99
push 0x2636
push 0
push 0x1191
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x43c5be
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x43c5d9
lea eax, [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push 0
push 1
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
call fcn.0044a81f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43d343
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43d3eb
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43d3c0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43d3a0
mov byte [ebp - 1], 0
push 0
push 0x5c7c
lea eax, [ebp - 1]
push eax
call fcn.004488c4
add esp, 0xc
jmp 0x43d3be
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43d3be
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x43d3e9
push 0x9b5
push 1
push 0
push 0x279c
push 1
push 0xc41
push 0x5147
push 1
push 0x178f
call fcn.00446d8b
add esp, 0x24
jmp 0x43d408
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0
push 0x1e1f
push dword [ebp - 0x24]
push 0x1491
call fcn.00443312
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x43ebf1
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43eca4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43ec91
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43ec73
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x43ec8f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43ec8f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x43eca2
push 0x56b3
push 1
push 1
call fcn.004377d9
add esp, 0xc
jmp 0x43ecba
push 0
push 1
push 0x1cbb
push 0x11f4
call fcn.00444b51
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43eeb3
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43ef3a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43ef1c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43ef10
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x43ef1a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x43ef38
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
push 0x718f
push 1
push 1
call fcn.00435fab
add esp, 0x14
jmp 0x43ef5f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.00438ddc
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4405e6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x440611
push 1
push 0x669
push 1
push 0x1d31
push 0x58fb
call fcn.00440694
add esp, 0x14
jmp 0x440690
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x440663
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x440659
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x440657
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x440661
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x440690
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x1100
push 0x4d67
push 0x5ecd
call fcn.004492a5
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x442269
Capabilities:
Create directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44233c
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4422f0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4422e6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4422e4
push 1
push 1
push 0x40ee
push 1
push 1
call fcn.00437981
add esp, 0x14
jmp 0x4422ee
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x442337
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x44232f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x44232d
push 1
push 0
push 0x20d6
call fcn.0044eced
add esp, 0xc
jmp 0x442337
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x442411
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4423cb
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x442386
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x4423c9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x4423a8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x4423c9
mov byte [ebp - 1], 0
push 0xab2
lea eax, [ebp - 1]
push eax
push 0
call fcn.00440147
add esp, 0xc
jmp 0x44239d
jmp 0x442411
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x4423ed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x442411
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
test eax, eax
je 0x442411
push 0x5174
push 0
call fcn.0043ee59
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4437a6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x44394d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4438e3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44386f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x44386d
push 0x3f31
push 1
push 0xbb
push 1
push 0x5188
push 0x7070
push 1
push 0x3092
push 0x5576
push 0x608d
push 1
call fcn.004382af
add esp, 0x2c
jmp 0x4438e1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4438a9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x18
jl 0x4438e1
push dword [ebp - 0xc]
push 0x5c31
push 0
push 1
push 1
push 0
push 1
push dword [ebp - 0x50]
push 1
push 0x5dde
call fcn.00473c04
add esp, 0x28
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x4438df
jmp 0x44389e
jmp 0x44389e
jmp 0x44394b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x443909
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x44394b
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x443937
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffed
jle 0x44394b
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
je 0x443949
jmp 0x44394b
jmp 0x44392c
jmp 0x44395b
push 0x2d57
push 1
call fcn.00435c65
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x443c64
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x443d08
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x443ce5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x443cba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x443ce3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x443ce3
push 0
push 0
push 0
push 0x4755
call fcn.00439854
add esp, 0x10
jmp 0x443d06
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 1
push 0x42dd
push 0x583b
push 0
push 1
call fcn.004376ca
add esp, 0x18
jmp 0x443d31
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 0x452e
push 1
push 0x1019
push 0x11e5
push dword [ebp - 0x28]
push 1
push 0x67e8
call fcn.0043f19b
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x4440c4
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4441bf
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44414d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x444137
mov byte [ebp - 1], 0
push 0x5f80
lea eax, [ebp - 1]
push eax
push 1
push 0x6f46
push 0
push 1
push 1
push 0x60eb
call fcn.0043a50b
add esp, 0x20
jmp 0x44414b
push 0x2048
push 0
push 0x959
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4441bd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4441a6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4441a4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x740
push 0x22c5
push 0x194d
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4441bd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4441d1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push 0
push dword [ebp - 0x3c]
call fcn.00438248
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x445269
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4452bc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44529d
push 0x3f41
push 1
call fcn.0044531d
pop ecx
pop ecx
jmp 0x4452ba
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x3a77
push 0x31e
push 0
push dword [ebp - 0x10]
call fcn.0044c7e0
add esp, 0x10
jmp 0x445319
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4452dc
push 1
call fcn.0043d0bc
pop ecx
jmp 0x445319
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44530a
mov byte [ebp - 1], 0
push 0
push 0x3fa6
lea eax, [ebp - 1]
push eax
push 0x2de0
call fcn.00477086
add esp, 0x10
jmp 0x445319
push 0x1076
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esp, ebp
pop ebp
ret

Function at 0x446f2f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x446ff8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x446fd8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x446fc2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x446fc0
push 1
push 1
push 1
push 0x6037
push 0x63d8
push 0x4e6f
push 1
push 0x5609
push 1
push 0x1965
call fcn.0043b47b
add esp, 0x28
jmp 0x446fd6
push 0x10ff
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x446ff6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
call fcn.0043cd0d
add esp, 0x10
jmp 0x447000
push 1
call fcn.0043610a
pop ecx
mov esp, ebp
pop ebp
ret