joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c17
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x413cdc
lea eax, [ebp + 0x34]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x413c96
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x413c80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x413c94
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x413c94
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x413cda
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x413cb6
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x413cda
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x413cda
push 0
push 0
push 1
call fcn.0040efa6
add esp, 0xc
jmp 0x413d29
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 1
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
push eax
call fcn.0040f083
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x414412
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4144cc
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x414487
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x414460
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41445e
push 0
call fcn.00416bc6
pop ecx
jmp 0x414485
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2492
push 0x1555
push 0x403
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4144ca
push 0x2f7
push 0x44c1
push 0x49b8
push 0x4434
push 0x7381
push 0x560a
push 0x3a7b
push 0
push 0x4d4
push 0x2a6c
push 0x1db
push 0
push 0x37dd
call fcn.004135ea
add esp, 0x34
jmp 0x4144e2
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
call fcn.004155be
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x415246
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x415339
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41528d
push 0x644f
push 0x5948
push 1
call fcn.00415359
add esp, 0xc
jmp 0x415337
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41530f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffe2
jmp 0x4152c5
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffffb
jne 0x41530d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41530b
push 1
push 0x10fa
push 0x3597
push 1
push 0x6728
push 0x211b
push 0x7c0d
push 0
push 1
push 0
push 0x2cd6
push 1
call fcn.0041a802
add esp, 0x30
jmp 0x4152ba
jmp 0x415337
push 0
push 0x14fb
push 0x18b4
push 0xbb7
push 0x1e28
push 0x10bf
push 0x22a8
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x415355
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.0041ac92
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4171b8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x417291
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x417251
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x417231
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41722f
push 0x7a2f
push 0x397c
push 1
push 1
push 1
push 1
push 0x75d
push 1
call fcn.00411e47
add esp, 0x20
jmp 0x41724f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41724f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x41728f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x417285
push 0
push 0
push 0x1199
push 0
push 0x12b3
push 0
push 0x67b
push 0x1972
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x41728f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x4172ff
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4172c1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push dword [ebp - 0x34]
call fcn.00414998
pop ecx
pop ecx
jmp 0x4172ff
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4172f5
mov byte [ebp - 2], 0
push 0x61fd
push 0
push 0
lea eax, [ebp - 2]
push eax
push 0x1ba8
push 1
push 1
call fcn.0041406c
add esp, 0x1c
jmp 0x4172ff
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esp, ebp
pop ebp
ret
Function at 0x42008d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4200c3
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x5dd1
push 1
push 1
call fcn.0042016b
add esp, 0x14
jmp 0x420167
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x420154
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x420136
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 8]
call fcn.00466fb7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 8], eax
jmp 0x420152
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x420152
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x420167
push 0x221f
push 1
push 1
push 1
call fcn.0040a691
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x42639f
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4264ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x426488
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x426448
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
jmp 0x426486
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x426486
push 0
push 0x14fb
push 0x18b4
push 0xbb7
push 0x1e28
push 0x10bf
push 0x22a8
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x4264ac
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
push 0x2b4
push 1
push 0x2da5
push 1
push 0x3ea1
call fcn.00419ddf
add esp, 0x18
jmp 0x4264c0
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x58], eax
push 1
push dword [ebp - 0x58]
call fcn.004141e4
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42bf0a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42bf9d
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42bf8d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0x604c
push 0x34b9
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.0042c1da
add esp, 0x20
jmp 0x42bf9b
push 0x335c
push 0
call fcn.0043145b
pop ecx
pop ecx
jmp 0x42c012
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x42c007
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x42bff4
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x42bff2
push 0x1992
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42c005
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
call fcn.0042e4ff
pop ecx
pop ecx
jmp 0x42c012
push 0
push 0
call fcn.00432536
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42d92b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x42d9f9
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42d9a1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 1
call fcn.0042da22
add esp, 0x14
jmp 0x42d9f7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x42d9d2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42d9d0
push 0x1487
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42d9f7
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jge 0x42d9f7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x42d9de
jmp 0x42da1e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x48], eax
push 0x5a9d
push dword [ebp - 0x44]
push 1
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
push eax
call fcn.0042c5d2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x42daf0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x42dbdb
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42db75
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.0042e43b
add esp, 0x18
jmp 0x42dbd9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x42dbb5
push 0
push 0x14fb
push 0x18b4
push 0xbb7
push 0x1e28
push 0x10bf
push 0x22a8
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x42dbd9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x42dbd9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x42dbf7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
push 0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.0042ba23
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x42dd23
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42dda5
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42dd67
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0
call fcn.0043af91
pop ecx
pop ecx
jmp 0x42dda3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42dd85
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x42dda3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42dda3
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x42ddd6
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42ddc5
push 0x2e0c
push 1
call fcn.0042c9c8
pop ecx
pop ecx
jmp 0x42ddd6
push 0
push 1
push 0x38fc
call fcn.0042baad
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x430163
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x430254
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43022c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4301f9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4301f7
push 1
push 0x5b0d
push 0x77e0
push 0xa8
push 0x6aa8
push 1
push 0x3bf5
push 0
push 0
push 1
push 0x323
call fcn.00434d2c
add esp, 0x2c
jmp 0x43022a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43022a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2492
push 0x1555
push 0x403
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x430252
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x1228
push 1
push 0x3187
push 1
push 0x61d4
push 0
push dword [ebp - 0x28]
call fcn.00437c3d
add esp, 0x1c
jmp 0x430262
push 0x3634
push 0
call fcn.004351a8
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x430ade
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x430ba1
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x430b2c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
push 0x4410
push dword [ebp - 0x14]
call fcn.00430bd5
add esp, 0xc
jmp 0x430b9f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x430b8b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x430b64
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffec
jg 0x430b89
mov byte [ebp - 1], 0
push 0
push 0x5146
lea eax, [ebp - 1]
push eax
push 0
push 0
call fcn.00430266
add esp, 0x14
jmp 0x430b59
jmp 0x430b9f
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x430b9f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x430bd1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push 1
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x30]
push 1
push 0x4e18
push dword [ebp - 0x34]
call fcn.004300d0
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x43149c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43154f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x431526
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43150e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43150c
push 1
push 0x2c53
push 0
push 0x2b6d
call fcn.0043667b
add esp, 0x10
jmp 0x431524
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x431524
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x43154d
push 0
push 0x19c2
push 1
push 0x1122
push 0x13b9
push 0x4e1b
push 1
push 0xda4
call fcn.00432592
add esp, 0x20
jmp 0x431560
push 0x1fc4
push 1
push 1
call fcn.004303a5
add esp, 0xc
mov esp, ebp
pop ebp
ret