joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a051
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43a0e7
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43a0cd
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a0c3
push 0x25d8
push 0xb63
push 0x249
push 0x1afb
push 0x1f32
push 0x251f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x43a0cb
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x43a0e5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0x6941
call fcn.0043a690
add esp, 0xc
jmp 0x43a106
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0x6ff8
push 0x15e3
push 0
push dword [ebp - 0x18]
push 1
call fcn.004455bf
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43d2cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43d30e
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x79c2
push 1
call fcn.0043d415
add esp, 0x14
jmp 0x43d411
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43d389
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43d366
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
and dword [eax], 0
jmp 0x43d384
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43d384
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x43d411
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43d3ec
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43d3ea
push 0x219c
push 0x1474
push 0x1acb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x912
push 0x318
push 0xabe
push 0x247a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x43d411
mov byte [ebp - 2], 0
push 0x36b6
push 0x61a3
push 1
push 1
lea eax, [ebp - 2]
push eax
push 0x35db
push 0
call fcn.00439760
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x440b70
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x440c57
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x440c2e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440bf4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x440bf2
push 0xe67
push 0x11c8
push 0x1d74
push 0x3e9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x440c2c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x440c2c
push 1
push 0
push 0x8e
push 1
push 0x6bff
push 0x7126
push 0x3061
call fcn.00433cac
add esp, 0x1c
jmp 0x440c52
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0
push 0
push dword [ebp - 0x28]
push 0x1e1d
push 0x8ea
push 0x359c
call fcn.0043d978
add esp, 0x18
jmp 0x440cf3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x440cca
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x440ca6
mov byte [ebp - 2], 0
push 1
push 0
lea eax, [ebp - 2]
push eax
push 1
push 0xcba
call fcn.00441e81
add esp, 0x14
jmp 0x440cc8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x440cc8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x440cf3
push 0x3b5b
push 1
push 0x4154
push 0x6e6d
push 1
push 1
push 1
push 0x585a
push 0x70f9
call fcn.00439ecd
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x440e9c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x440f88
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x440f32
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440f0b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x440f30
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x136e
push 0x5b1
push 0xe6c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x440f86
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x440f65
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 0x3342eb9
jmp 0x440f86
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x440f86
push 0x2697
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x440fc8
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x440fae
push 0x5825
push 1
call fcn.0043db5e
pop ecx
pop ecx
jmp 0x440fc8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0x444e
push dword [ebp - 0x50]
push 0
push 0
call fcn.0043a10a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x445ddf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x445f45
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x445f13
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x445e80
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x445e4f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x445e7b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x445e79
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x445e44
jmp 0x445f11
mov dword [ebp - 0xc], 0xffffffff
push 0x29ec
push 0x5c40
push 0x1e9d
push 0
push 0xa3a
push 1
push 1
call fcn.0043b262
add esp, 0x1c
mov dword [ebp - 0xc], 0
jmp 0x445eb9
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jl 0x445f11
mov dword [ebp - 0x28], 3
mov byte [ebp - 2], 0
push 0x1276
push 0x889
push 0
push 1
lea eax, [ebp - 2]
push eax
push 1
push 1
call fcn.0043a6d2
add esp, 0x1c
push 0x99c
push 0x4b40
push 0x5aa4
lea eax, [ebp - 0x28]
push eax
push 0x5fe
push 0
push 0x3d29
call fcn.0044a208
add esp, 0x1c
jmp 0x445eb2
jmp 0x445f43
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x445f2d
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x445f43
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x445f43
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x445f64
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push 1
push 0x30aa
push 0x117f
push dword [ebp - 0x34]
push 0
call fcn.0043d415
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x447561
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x4476a5
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44761b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4475fd
mov byte [ebp - 1], 0
push 0x38ea
push 0x79b1
push 0x4e2f
push 1
push 0x7ddf
push 1
push 0x6167
lea eax, [ebp - 1]
push eax
push 0x2b4b
push 0x4fa4
push 0x531b
push 1
push 1
push 0x2d90
push 0x51fd
call fcn.0044481a
add esp, 0x3c
jmp 0x447616
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x447616
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x4476a3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44768f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [eax], 0
jbe 0x44768d
push 1
push 1
push 0x5d33
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0x44]
push dword [eax]
mov eax, dword [ebp - 0x48]
push dword [eax]
call fcn.00433cac
add esp, 0x1c
jmp 0x447661
jmp 0x4476a3
push 0x1cb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4476e5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x50], eax
push 0x7118
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
push eax
call fcn.00433b0e
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x453661
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x453691
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push 0x3eac
push 1
push 0x2c55
push dword [ebp - 8]
call fcn.00453725
add esp, 0x10
jmp 0x453721
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4536ec
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4536e2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4536ea
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x453721
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0
push 0x421f
push 1
push dword [ebp - 0x28]
push 0x58b4
push 0x2b40
push 0x1b00
push 0x3eb3
push 1
push 0x7e0a
call fcn.0045d176
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x453b44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x453b87
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
push 0x744
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push 0x2ced
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
call fcn.00453bfa
add esp, 0x18
jmp 0x453bf6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x453bee
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x453bd2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x453bec
push 0x12cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x453bf6
push 0
call fcn.00457110
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x457164
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4571e2
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4571b7
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
push 0x206e
push 0x2489
push 0x52f4
push 0x3b63
push dword [ebp - 0xc]
call fcn.00457262
add esp, 0x18
jmp 0x4571e0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x5730
push 0
push 0x3d31
push 0
push dword [ebp - 0x14]
push 0x40a0
push 0x3a7b
call fcn.00453ea0
add esp, 0x1c
jmp 0x45725e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x45721f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x136e
push 0x5b1
push 0xe6c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x45725e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 1
push 0x5f09
push 0
push 0x8a8
push dword [ebp - 0x20]
push 0x1ac6
push 0x60c5
push 0x30a1
push 0x5dea
push 0x69e4
push 0
push 0x5b27
call fcn.0045e918
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x4592e7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4593ce
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4593aa
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x459386
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 0x14]
call fcn.0044ff06
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x4593a8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4593a8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x4593cc
push 0x19dd
push 1
push 0x1929
push 0x447a
push 1
push 0x4466
push 0
call fcn.004533fa
add esp, 0x1c
jmp 0x4593d6
push 1
call fcn.00454a1e
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45a641
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x45a676
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 1
push 1
push dword [ebp - 0x14]
call fcn.0045a726
add esp, 0x10
jmp 0x45a722
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x45a71a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x45a710
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffea
jmp 0x45a6ce
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x1a
jl 0x45a70e
mov dword [ebp - 0xc], 6
mov dword [ebp - 0xc], 0xfffffff8
jmp 0x45a6ed
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc
jle 0x45a70c
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x4ade
call fcn.0045ef1b
add esp, 0xc
jmp 0x45a6e6
jmp 0x45a6c3
jmp 0x45a718
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x45a722
push 0
call fcn.0045ca1f
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45bf91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45c101
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45c08c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x45c035
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
jmp 0x45c01f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x18
jl 0x45c033
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x45c031
jmp 0x45c033
jmp 0x45c014
jmp 0x45c08a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x45c063
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffed
jle 0x45c08a
mov eax, dword [ebp - 0x40]
mov dword [eax], 9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x45c088
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x45c058
jmp 0x45c0ff
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x45c0de
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x45c0dc
push 0x2195
push 1
push 0x2c99
push 0x4ac6
push 1
push 0x3e0a
push 0
push 1
call fcn.00455aef
add esp, 0x20
jmp 0x45c0ff
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x45c0ff
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x45c112
push 0x4dbb
push 0
push 1
call fcn.004576f3
add esp, 0xc
mov esp, ebp
pop ebp
ret