joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454050
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45e2c7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x472100]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401b40
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
jne 0x454149
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x454149
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x454149
lea ecx, [esp + 0x14]
call fcn.00453b20
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x45410b
add eax, 0xfffffff0
mov dword [esp + 0x20], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4540f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push eax
call fcn.00454050
add esp, 4
test eax, eax
jne 0x454137
lea eax, [esp + 0x14]
call fcn.00401a00
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0
push esi
call edi
test eax, eax
jne 0x454149
call ebx
cmp eax, 0xb7
jne 0x454118
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x45416a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x455a20
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
xor bl, bl
lea eax, [esp + 4]
push eax
mov byte [esi + 0x1c], bl
mov byte [esi + 0x32], 1
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov byte [esi + 0x36], bl
mov byte [esi + 0x37], 1
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x18]
or eax, 0xffffffff
mov byte [esi + 0x40], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x30], bl
mov dword [esi], ecx
mov dword [esi + 0x3c], 5
mov byte [esi + 0x38], 1
mov dword [esi + 4], 4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
pop ebx
add esp, 0x24
ret
Function at 0x458bb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ebp
xor ebx, ebx
call fcn.00401000
mov eax, dword [esp + 0x14]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x458c67
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x458c70
mov eax, dword [ebp]
sub eax, 0x10
mov dword [esp + 0x10], ebx
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea ecx, [edi + 1]
sub eax, ecx
or edx, eax
mov ebx, edi
jge 0x458c21
mov eax, ebp
call fcn.004015f0
mov ebp, dword [ebp]
mov dword [esp + 0x18], ebp
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458c7a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x458c7a
sub ebx, eax
add ebp, eax
test ebx, ebx
jne 0x458c28
mov edx, dword [esp + 0x18]
mov byte [edx + edi], bl
mov edi, dword [esp + 0x1c]
call fcn.00401060
pop edi
pop esi
pop ebp
lea eax, [ebx + 1]
pop ebx
pop ecx
ret 8
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x45bd30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45e887
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x472100]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x472100]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x26]
push ebp
push eax
mov word [esp + 0x2c], bp
call fcn.00413cd0
mov edx, dword [0x474db4]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x474db4
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x234], ebp
mov edx, dword [0x474db4]
mov eax, dword [edx + 0xc]
mov ecx, 0x474db4
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x234], 1
mov eax, dword [0x475e04]
cmp eax, ebp
je 0x45be72
lea ecx, [esp + 0x14]
push ecx
push str.installpath
push eax
call fcn.004021c0
test eax, eax
je 0x45be72
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004018f0
lea edx, [esp + 0x20]
add eax, 0x10
push edx
mov dword [esi], eax
call fcn.004535b0
add esp, 8
mov edi, 0x475db8
mov byte [esp + 0x234], 2
call fcn.00401500
mov byte [esp + 0x234], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45be46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x475db8]
push ecx
call fcn.00454050
add esp, 4
test eax, eax
je 0x45be63
mov ebp, 1
jmp 0x45bf20
mov edx, 0x467ad8
mov edi, 0x475db8
call fcn.00401b00
lea edx, [esp + 0x20]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x45bf16
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x45bea0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov eax, 0x475db8
call fcn.00401960
push 0x10
push str.TencentDownload_
push 0x475db8
call fcn.00401850
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str._x_
lea edi, [esp + 0x20]
call fcn.00401750
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx - 0xc]
add esp, 8
push eax
push ebx
push 0x475db8
call fcn.00401850
mov edx, dword [0x475db8]
push edx
call fcn.00454050
add esp, 4
test eax, eax
je 0x45bf16
mov ebp, 1
jmp 0x45bf20
mov esi, 0x475db8
call fcn.00401eb0
mov byte [esp + 0x234], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45bf48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x234], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45bf6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00410ae1
add esp, 0x224
ret
Function at 0x44bf70
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403f98
xor eax, eax
push ebp
push 0x44bfee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403fa8
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x44bfb9
mov eax, dword [ebx + 4]
call fcn.00403fa8
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bff5
lea eax, [ebp - 4]
call fcn.00403b64
ret

Function at 0x44cf90
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44d127
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040295c
cmp word [ebx + 0x9a], 0
je 0x44cfd9
mov edx, ebx
mov eax, dword [ebx + 0x9c]
call dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x44cfed
lea esi, [ebp - 8]
jmp 0x44cfef
xor esi, esi
cmp dword [ebx + 0x78], 0
jne 0x44cff9
xor edi, edi
jmp 0x44d003
mov eax, dword [ebx + 0x78]
call fcn.00403fa8
mov edi, eax
mov eax, dword [ebx + 0x74]
call fcn.00403fa8
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044c724
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
push esi
mov eax, dword [ebx + 0x6c]
call fcn.00403fa8
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
mov eax, ebx
call fcn.0044c858
push eax
mov eax, ebx
call fcn.0044c82c
push eax
mov eax, ebx
call fcn.0044c7e0
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0044c5f8
mov eax, dword [ebp - 0x18]
call fcn.00403fa8
push eax
mov eax, dword [ebx + 8]
call fcn.00403fa8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x88], eax
cmp dword [ebp - 0xc], 0
jne 0x44d08c
call fcn.0040b114
xor edx, edx
push ebp
push 0x44d105
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x44d0ca
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xa2], 0
je 0x44d0c0
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d0ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d10c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x44d138
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xaa], 0
je 0x44d164
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xac]
call dword [esi + 0xa8]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44d189
call fcn.0040b114
xor eax, eax
push ebp
push 0x44d1c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x44d1a9
call fcn.0040b114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1c7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x44ff44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450080
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x450098
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.004511c4
mov eax, dword [ebp - 4]
call fcn.00450a54
xor edx, edx
push ebp
push 0x450063
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x450002
test si, si
jne 0x44ffb4
mov eax, dword [ebp - 8]
call fcn.0040906c
mov esi, eax
cmp esi, 0xffff
jbe 0x44ffb4
call fcn.00402d98
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x450002
cmp eax, 0xffffffff
jle 0x44ffe3
sub ebx, eax
jmp 0x44fff2
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.004510f8
test ebx, ebx
je 0x450002
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x44ffb7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x45004d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4500b0
mov dl, 1
mov eax, dword [0x44f464]
call fcn.0040a0a8
call fcn.004035b0
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x45004d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45006a
mov eax, dword [ebp - 4]
call fcn.00450aac
ret
Function at 0x45059c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45071d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x450734
mov dl, 8
mov eax, ebx
call fcn.004511c4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00410b44
cmp byte [ebx + 0x10088], 0
jne 0x4506c9
xor eax, eax
mov dword [ebx + 0x10084], eax
mov eax, dword [ebp - 4]
call fcn.00410b50
mov dword [ebx + 0x100b0], eax
mov eax, dword [ebp - 4]
call fcn.00410b50
push eax
mov eax, dword [ebp - 4]
call fcn.00410b34
pop edx
xchg edx, eax
sub eax, edx
cmp eax, 0x10000
jle 0x450618
mov eax, 0x10000
lea edx, [ebx + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x45063f
call fcn.00402d98
lea eax, [ebx + eax + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x450707
test eax, eax
jle 0x45067f
sub esi, eax
add dword [ebx + 0x10084], eax
cmp word [ebx + 0x100c2], 0
je 0x45068d
mov edx, ebx
mov eax, dword [ebx + 0x100c4]
call dword [ebx + 0x100c0]
jmp 0x45068d
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.004510f8
mov eax, dword [0x45ba8c]
mov eax, dword [eax]
call fcn.004473a8
test esi, esi
je 0x4506a6
cmp byte [ebx + 0x10088], 0
je 0x45062b
mov eax, dword [ebp - 4]
call fcn.00410b50
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00410b34
cmp esi, eax
je 0x4506c9
cmp byte [ebx + 0x10088], 0
je 0x4505f7
cmp byte [ebx + 0x10088], 0
je 0x450707
mov byte [ebx + 0x10088], 0
mov ecx, 0x450748
mov dl, 1
mov eax, dword [0x44f464]
call fcn.0040a0a8
call fcn.004035b0
cmp word [ebx + 0x10282], 0
je 0x450707
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450724
lea eax, [ebp - 0xc]
call fcn.00403b64
ret
Function at 0x451000
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4510cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4510e0
mov dl, 4
mov eax, ebx
call fcn.004511c4
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x4510b6
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4510a8
test byte [ebx + 0x20], 8
jne 0x451065
cmp word [ebx + 0x1004a], 0
je 0x451065
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x4510b6
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x451088
call fcn.00402d98
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4510b6
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.004510f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4510d3
lea eax, [ebp - 4]
call fcn.00403b64
ret

Function at 0x45126c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x4512a8
mov dl, 8
mov eax, ebx
call fcn.004511c4
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x45129a
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x4562c8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45642c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d698]
call fcn.00402e28
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
push 5
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
mov eax, 0xc8
call fcn.0040272c
mov esi, eax
test ebx, ebx
jbe 0x45635d
push 0xc8
push esi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403d1c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408b04
cmp dword [ebp - 0x10], 0
je 0x45634f
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00403d1c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x456313
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x456411
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x456402
inc ebx
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00408930
mov edx, dword [ebp - 0xc]
mov eax, 0x456444
call fcn.004040d0
test eax, eax
je 0x4563cf
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
jmp 0x4563fc
mov edx, dword [ebp - 0xc]
mov eax, 0x456460
call fcn.004040d0
test eax, eax
je 0x4563fc
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
push 0
call sub.user32.dll_FindWindowA
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
inc dword [ebp - 8]
dec ebx
jne 0x456387
mov eax, esi
call fcn.00402744
mov eax, dword [ebp - 4]
call fcn.00402e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456433
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b88
ret

Function at 0x456924
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f98
xor eax, eax
push ebp
push 0x4569bc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408f78
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov esi, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
push eax
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569c3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b88
ret
Function at 0x456e2c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456f13
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x456edd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b64
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x456e9f
pop dword fs:[0]
add esp, 8
jmp 0x456ef2
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x456ec7
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.004092a4
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dec
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x456ea6
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456ee7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f1a
lea eax, [ebp - 0x204]
call fcn.00403b64
lea eax, [ebp - 8]
call fcn.00403b64
ret

Function at 0x457ec4
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x457eda
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x458294
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4583c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d698]
call fcn.00402e28
mov esi, eax
mov dl, 1
mov eax, dword [0x458e54]
call fcn.00402e28
mov edi, eax
lea edx, [ebp - 0xc]
mov eax, dword [0x45ba8c]
mov eax, dword [eax]
call fcn.00447a1c
mov ebx, 0x44
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403d0c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x4583dc
call fcn.00403e30
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x458392
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 8]
mov ecx, 0x4583e8
mov edx, dword [ebp - 4]
call fcn.00403e30
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00458fb4
lea eax, [ebp - 0x10]
call fcn.00457054
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00458eb0
mov edx, 0x4583fc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, 0x458410
call fcn.00403e30
mov edx, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004593a0
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408e84
inc ebx
cmp ebx, 0x46
jne 0x4582e1
mov eax, esi
call fcn.00402e58
mov eax, edi
call fcn.00402e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4583cc
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403b88
ret