joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4556d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x488c0c]
cmp dword [eax + 0x30], 0
je 0x455782
cmp dword [ebx + 0x94], 0
jne 0x45577c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x455668
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45577c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x455742
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45577c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416514
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x455751
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x456260
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456295
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044cc
jmp 0x4562a2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404430
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457340
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x457381
mov eax, esi
call fcn.0043d310
test al, al
je 0x457381
mov eax, dword [ebx + 0x84]
call fcn.0043d00c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x457381
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d00c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45ce3c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45ce6a
mov eax, ebx
call fcn.0045d8f4
cmp dword [ebx + 0x3c], 0
je 0x45ce63
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x45cedb
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x45cecd
cmp dword [ebx + 8], 0
je 0x45ce8c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x45ce9e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45cecd
cmp dword [ebx + 8], 0
je 0x45ce7f
cmp eax, 3
je 0x45ceb1
dec eax
jne 0x45ce7f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45ce7f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x45ce7f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x45cef9
cmp dword [ebx + 0x10], 0xcc
je 0x45cef9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0045cf04
pop ebx
ret
Function at 0x46e554
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e6bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404474
mov eax, dword [ebp - 0x10]
call fcn.0046e0c8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x46e5a6
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040492c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046eb20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46e67b
xor eax, eax
push ebp
push 0x46e674
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046e274
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0046e6ec
test al, al
je 0x46e652
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004044cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46e652
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040488c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x46e64c
mov eax, dword [ebp - 0x14]
call fcn.0040488c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004045cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0046e554
dec ebx
cmp ebx, 0xffffffff
jne 0x46e605
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e67b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0046e274
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040488c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0046e260
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e6c4
lea eax, [ebp - 0x3c]
call fcn.004043dc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404400
ret
Function at 0x46e67b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e6bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404474
mov eax, dword [ebp - 0x10]
call fcn.0046e0c8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x46e5a6
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040492c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046eb20
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46e67b
xor eax, eax
push ebp
push 0x46e674
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0046e274
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0046e6ec
test al, al
je 0x46e652
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004044cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x46e652
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040488c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x46e64c
mov eax, dword [ebp - 0x14]
call fcn.0040488c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004045cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0046e554
dec ebx
cmp ebx, 0xffffffff
jne 0x46e605
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e67b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0046e274
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040488c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0046e260
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e6c4
lea eax, [ebp - 0x3c]
call fcn.004043dc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404400
ret

Function at 0x46e6ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402f84
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x48752c]
cmp byte [edx + 0xc], 0
je 0x46e750
mov edx, dword [0x487524]
cmp dword [edx], 2
jne 0x46e750
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x46e754
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46e80c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0046e6ec
test al, al
je 0x46e7ee
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004044cc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x46e7ee
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040488c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.0040488c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004045cc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x46e7a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e813
lea eax, [ebp - 0x2c]
call fcn.004043dc
lea eax, [ebp - 0xc]
call fcn.004043dc
ret

Function at 0x46ea44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0046e0dc
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040488c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x46eaa2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x48734c]
mov dl, 1
mov eax, dword [0x46dfd4]
call fcn.0040c244
call fcn.00403e3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46eaac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040488c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x46eb04
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x487538]
mov dl, 1
mov eax, dword [0x46dfd4]
call fcn.0040c244
call fcn.00403e3c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0046e10c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x479eb8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
call fcn.0040487c
xor eax, eax
push ebp
push 0x479f37
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.00404694
mov ecx, eax
test ecx, ecx
jle 0x479f1f
mov esi, 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax + esi - 1]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x4866f8]
shr ebx, 8
and ebx, 0xffffff
xor eax, ebx
mov ebx, eax
inc esi
dec ecx
jne 0x479ee9
not ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479f3e
lea eax, [ebp + 8]
call fcn.004043dc
ret
Function at 0x47d560
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x47d748
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404474
lea edx, [ebp - 0x41c]
mov eax, dword [ebp - 0x14]
call fcn.00408728
mov edx, dword [ebp - 0x41c]
mov eax, 0x47d764
call fcn.004049d0
test eax, eax
jne 0x47d5ce
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x47d764
call fcn.004046e0
lea eax, [ebp - 0x18]
mov edx, 0x47d774
call fcn.00404474
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.0040488c
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47d722
xor eax, eax
push ebp
push 0x47d71b
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jle 0x47d617
mov edi, 0x88000000
jmp 0x47d61c
mov edi, 0x8c400000
push 0
push edi
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040488c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47d6fd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x47d6e6
test esi, esi
jle 0x47d6a8
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetSetFilePointer
cmp eax, esi
jne 0x47d6e6
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x418]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
jne 0x47d668
mov eax, dword [ebx]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov byte [ebp - 1], 1
jmp 0x47d6e6
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x418]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp dword [ebp - 0x10], 0
jne 0x47d6a8
mov eax, dword [ebx]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d704
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d74f
lea eax, [ebp - 0x41c]
call fcn.004043dc
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404400
ret
Function at 0x47d848
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040487c
xor eax, eax
push ebp
push 0x47d8ab
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040488c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x47d895
mov ebx, dword [ebp - 8]
add ebx, dword [ebp - 0xc]
add ebx, dword [ebp - 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d8b2
lea eax, [ebp - 4]
call fcn.004043dc
ret

Function at 0x47de8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f84
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0x41
cmp byte [ebp + 0xc], 0
je 0x47debe
mov word [ebp - 0x14], 0
jmp 0x47dec4
mov word [ebp - 0x14], 1
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.0040488c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp + 0x10], 0
je 0x47df0e
test bl, bl
je 0x47df0e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.user32.dll_WaitForInputIdle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x47df18
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.0040487c
xor eax, eax
push ebp
push 0x47dfea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0x47dffc
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404644
lea eax, [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov edx, 0x47e00c
call fcn.004046e0
mov eax, dword [ebp - 0x114]
call fcn.0040488c
mov edx, eax
lea eax, [ebp - 0x110]
call fcn.004045cc
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
call fcn.0040469c
push 1
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0047de8c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dff1
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404400
lea eax, [ebp - 4]
call fcn.004043dc
lea eax, [ebp + 8]
call fcn.004043dc
ret
Function at 0x47e0cc
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x47e18f
xor ecx, ecx
push ebp
push 0x47e188
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x47e171
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x47e16b
mov eax, dword [ebx]
dec eax
test eax, eax
jl 0x47e157
inc eax
xor edx, edx
lea ecx, [edx + edx*2]
or dword [ebx + ecx*4 + 0xc], 2
inc edx
dec eax
jne 0x47e14b
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push ebx
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e18f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x47e610
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4d
push 0
push 0
dec ecx
jne 0x47e618
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x47e787
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x47e719
mov eax, dword [0x487524]
cmp dword [eax], 2
jne 0x47e763
mov dword [ebp - 0x228], 0x224
lea ecx, [ebp - 0x228]
mov edx, edi
mov eax, esi
call fcn.0047e54c
test al, al
je 0x47e763
xor edx, edx
push ebp
push 0x47e70b
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.0047e0cc
mov eax, esi
push eax
push 0
push 0x2a
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0x47e79c
push 0x47e7a8
call sub.kernel32.dll_GetModuleHandleA_3
push eax
call sub.kernel32.dll_GetProcAddress_2
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp - 0x214]
push eax
push ebx
push 0
push 0
push esi
call sub.kernel32.dll_CreateRemoteThread
mov edx, eax
lea eax, [ebp - 0x238]
mov cl, 4
call fcn.0040537c
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x248]
call fcn.00412478
lea edx, [ebp - 0x248]
pop eax
call fcn.004053e8
setne al
mov ebx, eax
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e763
mov eax, edi
call fcn.0040488c
push eax
call sub.kernel32.dll_GetModuleHandleA_3
mov esi, eax
lea eax, [ebp - 0x258]
mov edx, esi
mov cl, 4
call fcn.0040537c
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x268]
call fcn.00412478
lea edx, [ebp - 0x268]
pop eax
call fcn.004053e8
je 0x47e763
push esi
call sub.kernel32.dll_FreeLibrary_1
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e78e
lea eax, [ebp - 0x268]
mov edx, dword [0x40109c]
mov ecx, 4
call fcn.00404f34
ret

Function at 0x47eb34
Capabilities:
Modify service

Disassembly:
push ebx
push esi
mov esi, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 2
push esi
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
pop esi
pop ebx
ret

Function at 0x47eb7c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47ebeb
xor eax, eax
push ebp
push 0x47ebe4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ebeb
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f3a8
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
push 0
push ebx
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x8c8b36bd
add eax, 0x73b5079c
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2c464e60
sub dword [ebp - 0x48], 0xddf40915
mov dword [ebp - 0x44], 0xf10822b6
add dword [ebp - 0x44], 0x412b298f
mov dword [ebp - 0x40], 0xa3395eb0
add dword [ebp - 0x40], 0xa912e57e
mov dword [ebp - 0x3c], 0xf8fc757e
sub dword [ebp - 0x3c], 0xf8fc757e
lea eax, [ebp - 0x48]
push eax
mov eax, 0xd33b46fb
add eax, 0x2d053991
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9ff73d9e
sub dword [ebp - 0x48], 0x2b84d448
mov dword [ebp - 0x44], 0x9b46f915
sub dword [ebp - 0x44], 0x59da97a0
mov dword [ebp - 0x40], 0x25dbccb7
add dword [ebp - 0x40], 0x3d939fb5
mov dword [ebp - 0x3c], 0xe013dfbc
add dword [ebp - 0x3c], 0x1fec2044
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3363d
push 0
call eax
mov ecx, 0xac842966
add ecx, 0x537c112c
mov esi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x38]
mov ebx, 0x8f607a51
sub dword [ebp - 0x28], 0xe443a022
mov edi, dword [edx]
xor dword [ebp - 0x2c], ecx
xor edi, ebx
mov dword [ebp - 0x24], 0xbb780892
mov dword [esi], edi
xor dword [ebp - 0x30], 0x7ae37cbb
add esi, 0xbe7282d1
add esi, 0x418d7d33
add edx, 0x62d3c15b
sub edx, 0x62d3c157
loop 0x403f6a
add eax, 0x6a9cb17
sub eax, 0x6a8edfc
xor ebx, ebx
add ebx, eax
add eax, 0xfebbdfce
sub eax, 0xfebbdfc9
mov ecx, 0xb7507025
add ecx, 0x48ef8fdb
add ecx, dword [ebp - 0x38]
call ebx
leave
ret