joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422828
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42284f
call fcn.0040caf5
mov dword [eax], esi
call fcn.0040cae2
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040beea
mov eax, esi
jmp 0x4228a4
test dword [ebp + 0xc], 0xfffffff9
jne 0x422835
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42287c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040cb08
pop ecx
call fcn.0040cae2
mov eax, dword [eax]
jmp 0x4228a4
test al, 0x10
jne 0x4228a2
test al, 1
je 0x4228a2
test byte [ebp + 0xc], 2
je 0x4228a2
call fcn.0040caf5
mov dword [eax], 5
call fcn.0040cae2
mov dword [eax], 0xd
jmp 0x422873
xor eax, eax
pop esi
pop ebp
ret

Function at 0x413093
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x3069eb67
xor al, dh
mov ebp, 0xe869e867
call 0x5890e01d
cmp eax, 0x3069eb67
pop ecx
invalid
xchg ecx, eax
mov ebp, 0xd87811e6
xor byte [ecx], bh
je 0x413075
fcomp st(0)
rcl byte [ecx]
push ebp
sub dword [edi + 0x58], ecx
cmp eax, 0x7169e967
mov al, 0x26
xchg ecx, eax
shr byte [eax - 0x26594f8f], 1
and dword [ecx + ebx], esp
call 0x3109cda3
imul esi, edx, 0xe80da62c
jno 0x413100
cmpsb byte [esi], byte es:[edi]
xchg ecx, eax
cmp eax, 0xa43d55a6
clc
call 0xc1b919b8
sbb eax, ebp
call 0xd9af97e8
and dword [ecx + ecx - 0x18], edi
call 0xbe619e4d
wait
hlt
pop ebp
test al, 0xed
outsd dx, dword [esi]
call 0xb22a1912
cmp eax, 0x3db1eda7
in ax, dx
mov eax, dword [bx + di]
call 0xe9664300
xor esp, esp
and byte [edx + 0x55], cl
cmp eax, 0xe8e8f8e3
call 0x5dc2eabe
test al, 0x61
cmp eax, 0x663d55a7
clc
call 0x3df31a1c
cmpsd dword [esi], dword es:[edi]
jno 0x413174
cmpsb byte [esi], byte es:[edi]
ja 0x413137
sbb eax, ebp
call 0x55528ad2
sub dword [ebp + eax*2 + 0x2026b071], ebx
retf
ja 0x41319e
sbb eax, ebp
call 0xde81d6d
call 0xede76ef1
xchg ecx, eax
and al, 0xd8
fdivr dword [esi + 0x77]
call 0x122a19a5
push 0x41d1d9ef
clc
call 0x20630b7f
clc
call 0x3fa94385
fldenv [ecx - 0x1717f669]
mov eax, dword [0xe8e80997]
adc dword [eax + 0x5f], ebp
fld st(1)
loop 0x413172
fcomp st(0)
adc dword [eax + 0x7f], ebp
and byte [esi + 0x11], bh
push 0x11da20cf
push 0xd531d9df
xor ebp, edx
or eax, ebp
call 0xe0a86f0b
push ebp
cmp eax, 0xe8e86966
call 0xbe31aeee
call 0x982a19dd
in al, dx
xchg ecx, eax
pop esp
adc dword [ebp + 0x29], edx
jno 0x41318c
shr al, 1
call 0x221b1617
sbb eax, ebp
call 0xeaa86f36
and byte [ecx + 0x4f], bh
xchg ecx, eax
cmp eax, 0x49714fa5
xchg edi, eax
cmp dword [ecx + 0x4971a53d], edx
push ebp
cmp eax, 0xe8e8f8e3
call 0xe85aa380
call 0xeca8ef1f
push ebp
cmp eax, 0xe8e88966
call 0x4fa8efaa
xor dword [ebp + 0x27], esi
jno 0x41323b
clc
call 0x919ac40c
pop esi
sub dword [ecx], edx
push ebp
imul esi, dword [edi - 0x61], 0x30e8e8f8
leave
loopne 0x4131ba
pop edi
xor byte [ebp + 0x55], bl
cmp eax, 0xe8e8f8e6
call 0x3dbdfed7
out 0xc0, al
sbb dword [ecx + 0x3d], esi
out 0xf0, al
mov al, 0xe6
adc ebp, eax
call 0x91fcf338
xor dh, ah
invalid
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x482269
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x56f5a7
call fcn.005479eb
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004027a0
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x57ffc8
call fcn.004111de
cmp eax, 0xffffffff
jne 0x482344
push 0
push 0x58b1d8
lea ecx, [ebp - 0x278]
call fcn.004111de
cmp eax, 0xffffffff
jne 0x482344
push 0
push 0x57ff34
lea ecx, [ebp - 0x278]
call fcn.004111de
cmp eax, 0xffffffff
jne 0x482344
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.004027a0
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x482313
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x579a14]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.0040cf92
jmp 0x48237d
lea eax, [ebp - 0x114]
push eax
call fcn.005503e0
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.004062f0
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040cf92
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x48236a
mov edi, dword [ebp - 0x274]
jmp 0x48237d
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x579a14]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040cf92
mov eax, edi
call fcn.0054799a
ret

Function at 0x5040e6
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0055910e
pop ecx
test eax, eax
jne 0x504128
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040f0a8
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5040ee
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x560927
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056079d

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x19321b78
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7a993c31
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x436ca9
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x436d6c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436cfd
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x6ff9
push dword [ebp - 0xc]
push 1
call fcn.00436d8c
add esp, 0xc
jmp 0x436d6a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x436d45
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
jmp 0x436d6a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1670
push 0xd80
push 0x1bf7
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x436d88
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
call fcn.00445431
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x438b0a
Capabilities:
Set registry value
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x438ba1
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x438b87
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x438b5e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x438b5c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x438b85
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x438b85
push 0x13c9
push 0
push 0x1ddf
push 0xebc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x438b9f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x6842
call fcn.004744c9
add esp, 0xc
jmp 0x438bc4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push 0
push 0x3d19
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
call fcn.0043d2be
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43a64a
Capabilities:
Get common file path
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43a6f6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a6a6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x17a1
push 0x6e94
push 0
push dword [ebp - 0x1c]
call fcn.00446b93
add esp, 0x14
jmp 0x43a6f1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43a6c0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x43a6f1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43a6f1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x253b
push 0xc71
push 0x1723
push 0x22e0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x43a79c
lea eax, [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43a760
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43a739
push 0
push 0
push 0x229e
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x43a75e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1670
push 0xd80
push 0x1bf7
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x43a79c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43a78f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43a79c
push 0x1c02
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x43ed78
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43ee4b
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43edcc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push 0x5d01
push dword [ebp - 0x10]
call fcn.0043ee91
add esp, 0xc
jmp 0x43ee49
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43ee03
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6e5
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x43ee49
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xb
jmp 0x43ee31
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff4
jle 0x43ee49
mov eax, dword [ebp - 4]
imul eax, dword [eax], 0xffff
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
jmp 0x43ee26
jmp 0x43ee8d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 1
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
push eax
push 0
push dword [ebp - 0x44]
push 0x7b84
push dword [ebp - 0x48]
call fcn.0043e759
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43f6ef
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43f7d4
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43f780
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43f767
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43f765
push 0
push 1
push 0
push 1
call fcn.00474ab9
add esp, 0x10
jmp 0x43f77e
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x6d9b
push 0
call fcn.0043ff28
add esp, 0xc
jmp 0x43f7d2
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43f7ae
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43f7ac
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x43f7d2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43f7d2
push 0x2b60
push 0
call fcn.004401bd
pop ecx
pop ecx
jmp 0x43f84c
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43f827
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43f81a
push 0xe4d
push 0x9e4
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x43f825
push 0x570
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x43f84c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
push 0x2141
push 0
push 0
push dword [ebp - 0x54]
push 1
call fcn.00445004
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x446c51
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x446c96
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push 0x591c
call fcn.00446cf6
add esp, 0x1c
jmp 0x446cf2
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x446cb6
push 0
call fcn.00439401
pop ecx
jmp 0x446cf2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x446cd2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x446cf2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x446cf2
push 0x19a3
push 0
push 0
push 0xdbe
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esp, ebp
pop ebp
ret

Function at 0x449f91
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x44a085
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44a075
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44a063
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x44a02b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x44a061
push 1
push 1
push 0x71e
push dword [ebp - 0x38]
push 0
push 0x3bec
push dword [ebp - 4]
push 1
push dword [ebp - 0x3c]
push 0x2eaa
push 1
push 1
call fcn.0043e789
add esp, 0x30
jmp 0x44a020
jmp 0x44a073
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x44a083
push 0
push 0x45a5
call fcn.0047551f
pop ecx
pop ecx
jmp 0x44a09b
push 0x5a31
push 0x12fc
push 1
push 0
call fcn.00446640
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x473c89
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x473d56
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x473d08
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x473cef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x473d06
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x473d54
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x473d4a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x473d48
push 0x2179
push 0
push 0x2033
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x473d54
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x473dca
lea eax, [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x473d82
push 1
push 0x2b30
call fcn.00449a22
pop ecx
pop ecx
jmp 0x473dca
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0x3cbe
push 1
push 0x722d
push 0x207b
push dword [ebp - 0x44]
push 1
push 0x5ab8
push 0x48a
push 0x266e
push dword [ebp - 0x48]
push 0x3b22
push 0x7e61
push 0
call fcn.0043a7fa
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x48d5d3
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x48d609
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x727c
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push 1
call fcn.00490ed8
add esp, 0x14
jmp 0x48d6b0
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x48d65c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x48d64c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x48d65a
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x48d6b0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x48d699
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1670
push 0xd80
push 0x1bf7
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x48d6b0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret