joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4431f5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x443351
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4432ec
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44329f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44329d
push 1
push 0x584
push 0
push 0x3823
push 0
push 0x7547
push 0
call fcn.00438791
add esp, 0x1c
jmp 0x4432ea
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4432cd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x4432ea
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.0042f416
mov dword [eax], 0x4d07
jmp 0x4432c2
jmp 0x44334f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x44331b
push 0x2467
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x44334f
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
call fcn.004728c2
mov esi, eax
mov ecx, dword [ebp - 0x60]
call fcn.00403844
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x64]
mov dword [eax], edx
jmp 0x44337b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x68], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x6c], eax
push 1
push dword [ebp - 0x68]
push 0x3e4b
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
push eax
push 0x1267
call fcn.00438df6
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x445fee
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4460ff
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x446079
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44606e
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 1
push 0x3d13
push 0x1731
push 0
push 1
push 0x5ff5
push 0x2887
push 1
push 1
call fcn.0043ba6b
add esp, 0x28
jmp 0x446074
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x4460fd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4460e8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4460c9
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x4460e6
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.0042f416
mov dword [eax], 0x548f9f0a
jmp 0x4460be
jmp 0x4460fd
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [eax], 0xfffffffe
jmp 0x44610d
push 0x104b
push 0
call fcn.00441fab
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x446c96
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x446d2a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x446ce3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push 0x104c
push 0x6a63
push dword [ebp - 0x10]
call fcn.00446da5
add esp, 0x10
jmp 0x446d28
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x446d06
push 0x1053
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x446d28
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x446d28
push 0x321e
push 0
push 0x4f06
push 1
call fcn.0043591c
add esp, 0x10
jmp 0x446da1
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x446d93
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x446d7d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x446d7b
push 1
push 0x72ec
push 1
push 0x240d
push 0
push 0x5bd4
push 0
call fcn.00438791
add esp, 0x1c
jmp 0x446d91
push 0
push 0x2fc
push 0x1fae
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x446da1
push 0x3380
push 0
call fcn.0043e706
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x447b7f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x447ba0
push 1
push 0x1a14
call fcn.00447c6c
pop ecx
pop ecx
jmp 0x447c68
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x447c3d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x447c2e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x447c20
mov eax, 0xffffa741
test eax, eax
je 0x447c20
mov dword [ebp - 8], 1
jmp 0x447c24
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x447c3b
push 0x33c
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x447c68
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push 0
push dword [ebp - 0x38]
push 0xaa5
push 1
push 0x3d41
push 0x7b88
push 0x22c2
call fcn.00449199
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x448aab
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x448b74
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448b27
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x448b1a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x448b25
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x448b6f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x448b5a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 1
jmp 0x448b6f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [eax], 0xbfb2c41a
jmp 0x448c05
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x448be5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
push 0x4515
push dword [ebp - 0x60]
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0x1b27
call fcn.0044c5ad
add esp, 0x20
jmp 0x448c05
push 0x1adc
push 0
push 0
push 0x7803
push 0x1c14
push 0x3761
call fcn.0043c16b
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x44994d
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x449b0f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x449aaa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x449a50
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xb
jmp 0x4499e5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe8
jl 0x449a4e
mov byte [ebp - 1], 0
push 0x5d6b
push 1
push 1
push 1
push 0x7c61
push 0x1b7d
push 1
push 0x7390
push 0x3b4c
push 1
push 0x73b5
push 0x3365
push 0x2901
push 1
push 0x1bea
lea eax, [ebp - 1]
push eax
push 0x6ab5
push 1
push 0x196f
call fcn.0043a711
add esp, 0x4c
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x449a4c
jmp 0x449a4e
jmp 0x4499da
jmp 0x449aa8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x449a8a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 1
jg 0x449aa8
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.0042f416
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x449a7f
jmp 0x449b0d
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x449ae1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xbb6
push 0x2432
push 0x16dc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x449b0d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x449b0d
push 0
push 0x1de7
push 0
push 0x267f
push 0x1036
push 0
push 0x5f5
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x449b25
push 1
push 0x2a4f
push 1
push 0x291b
call fcn.00435984
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44a340
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44a3b7
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x44a374
push 1
call fcn.0044a3d1
pop ecx
jmp 0x44a3b5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44a3aa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44a3a8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x44a3b5
push 0x787
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x44a3cd
push 0x51ba
push 1
push 0x2a96
push 0
call fcn.00444b9f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44edb9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x44ee27
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44ee02
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push 0x5dba
push 0x684d
push dword [ebp - 0x10]
call fcn.0044ef87
add esp, 0x10
jmp 0x44ee22
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44ee1c
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44ee22
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x44ef83
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44ef47
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44eef9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44ee95
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 9
jge 0x44eef7
push 0
push 0x50c7
push 1
push 1
push 1
push 1
call fcn.00446c96
add esp, 0x18
push 1
push 0x7e37
push 0x503e
push 0x6742
push 0x3c8d
push 0x4e00
push 0
push 1
push 1
push 1
push 0x406a
push 1
push 0x10fa
push 0x5795
push 0x7df4
call fcn.00442173
add esp, 0x3c
jmp 0x44ee8a
jmp 0x44ef45
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x44ef45
push 0
push 0x2864
push 1
push 0x116c
push 0x11e6
push 0
push 0x3019
push 0x703a
push 0x568a
push 0x7903
push 0x41db
call fcn.00440be7
add esp, 0x2c
jmp 0x44ef83
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 1
push 0x2889
push 0x1a4c
push 0x556e
push 0x5ff6
push 1
push 0x5628
push 0x6ab9
push 0x4801
push 0
push 1
call fcn.0044b3a1
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x450a22
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x450a78
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x450a5c
push 0x1018
push 1
push 0x5e06
call fcn.00450aeb
add esp, 0xc
jmp 0x450a76
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x4b3
push 0
push 1
push dword [ebp - 0x10]
call fcn.004434bb
add esp, 0x10
jmp 0x450ae7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x450ad5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x450abc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x450ad3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x450ae7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0
call fcn.0044c9a0
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x453941
Capabilities:
Get file size
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x453a7e
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4539ff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4539d6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4539d4
push 1
push 0x39d4
push 1
push 1
push 0x4c1f
push 0x7f3e
push 0
push 1
call fcn.00444eef
add esp, 0x20
jmp 0x4539fd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4539fd
push 0x2467
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x453a7c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x453a3a
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 1
push 0
push 0x19ef
push 0x538f
push 0x4dcd
call fcn.004549f2
add esp, 0x18
jmp 0x453a7c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x453a5c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 9
jne 0x453a7c
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x453a7a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x453a51
jmp 0x453aa8
lea eax, [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x50], eax
push 0x1462
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push 0
push dword [ebp - 0x50]
push 0x2ce3
call fcn.00441c95
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x478716
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret