joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45044c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x450484]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450465
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450474
or bl, 4
test esi, 0x20000000
je 0x45047f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x456b2c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x456b3e
add esp, 0xfffffff0
call fcn.00403474
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041955c
mov eax, dword [0x45cf58]
mov dword [eax + 4], ebx
mov dword [eax], 0x456ed0
mov eax, dword [0x45cf64]
mov dword [eax + 4], ebx
mov dword [eax], 0x456edc
mov eax, ebx
call fcn.00456ee8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x453304
push eax
push 0
push 0
mov eax, dword [0x45d0ac]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41afc8]
call fcn.0041c73c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41afc8]
call fcn.0041c73c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41afc8]
call fcn.0041c73c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00457308
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4571e4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4571e4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4571e4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x456c7b
call fcn.004034cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x456fc8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457173
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x457154
mov dl, 1
mov eax, dword [0x411c58]
call fcn.00403120
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ea0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x457143
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00444b1c
test al, al
je 0x457136
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x457184
lea eax, [ebp - 0x254]
call fcn.00408bcc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x457136
xor eax, eax
push ebp
push 0x45712f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4571bc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x457118
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404110
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x457118
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404110
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457136
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x457039
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041574c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45717a
lea eax, [ebp - 0x260]
call fcn.00403ea0
ret

Function at 0x457aa8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45ebdc]
cmp byte [eax + 0xa5], 0
jne 0x457b19
cmp dword [0x45ebf4], 0
jne 0x457ada
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x457a64
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45ebf4], eax
cmp dword [0x45ebf0], 0
jne 0x457af5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45ebf0], eax
cmp dword [0x45ebf8], 0
jne 0x457b19
push esp
push 0
push 0
push 0x457a08
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45ebf8], eax
pop edx
ret
Function at 0x457c10
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x457c27
add esp, 0xfffffff0
call fcn.00403474
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041955c
mov eax, dword [0x45d098]
cmp word [eax + 2], 0
jne 0x457c4f
mov eax, dword [0x45d098]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459378
mov eax, dword [0x45d144]
cmp word [eax + 2], 0
jne 0x457c69
mov eax, dword [0x45d144]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459570
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41183c]
call fcn.00403120
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41baa8]
call fcn.00422f2c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x457df0
mov eax, dword [0x45cfb8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004232fc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459b10
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45cfb8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c29c
test eax, eax
je 0x457d5e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004085c0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c2c4
test eax, eax
je 0x457d72
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404110
mov eax, dword [0x45cea4]
cmp byte [eax], 0
jne 0x457da6
mov eax, ebx
call fcn.00457f18
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00459cec
mov eax, ebx
call fcn.0045a6b0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457de6
call fcn.004034cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458198
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45ebdc]
cmp dword [eax + 0x30], 0
je 0x458242
cmp dword [ebx + 0x94], 0
jne 0x45823c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458128
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45823c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458202
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45823c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413ba4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458211
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458da4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x458dd9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f90
jmp 0x458de6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ef4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x459ec8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x459f09
mov eax, esi
call fcn.00440104
test al, al
je 0x459f09
mov eax, dword [ebx + 0x84]
call fcn.0043fe00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x459f09
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fe00
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45ac08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404350
xor eax, eax
push ebp
push 0x45acb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404360
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45ac9e
mov eax, ebx
call fcn.004026cc
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x45acc8
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 8]
shr edx, 0x10
mov ecx, dword [ebp - 8]
mov word [ecx], dx
mov ax, word [eax + 8]
and ax, 0xffff
mov edx, dword [ebp - 0xc]
mov word [edx], ax
mov edx, ebx
mov eax, esi
call fcn.004026ec
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45acbb
lea eax, [ebp - 4]
call fcn.00403ea0
ret
Function at 0x45b7cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov eax, dword [ebp - 4]
call fcn.00404350
xor eax, eax
push ebp
push 0x45b827
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
call fcn.0040861c
push eax
push 0x45b834
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b82e
lea eax, [ebp - 4]
call fcn.00403ea0
ret
Function at 0x401404
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401416
mov eax, dword [0x4a608b]
shl eax, 2
mov dword [0x4a608f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0049934c
pop edx
call fcn.004992b0
call fcn.0049938c
push 0
call fcn.0049a828
pop ecx
push 0x4a6034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4a6093], eax
push 0
jmp fcn.004a0804
Function at 0x40cbc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
mov ebx, eax
mov eax, 0x4ab4a0
call fcn.00499b88
mov word [ebp - 0x34], 0x14
mov edx, dword [ebx + 0x330]
lea eax, [ebp - 4]
add edx, 0x464
call fcn.004a4af0
inc dword [ebp - 0x28]
xor edx, edx
mov word [ebp - 0x34], 8
mov word [ebp - 0x34], 0x20
mov dword [ebp - 8], edx
lea edx, [ebp - 8]
inc dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.004a4e60
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004a4c04
dec dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x34], 0x2c
mov edx, 0x4a80ad
lea eax, [ebp - 0xc]
call fcn.004a4ab8
inc dword [ebp - 0x28]
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x330]
add eax, 0x44c
call fcn.004a4cb8
test al, al
je 0x40cc9b
mov edx, 0x4a80b8
lea eax, [ebp - 0x10]
call fcn.004a4ab8
inc dword [ebp - 0x28]
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.004a4e3c
test eax, eax
lea eax, [ebp - 0x10]
setne cl
and ecx, 1
mov edx, 2
push ecx
dec dword [ebp - 0x28]
call fcn.004a4bd4
pop ecx
test ecx, ecx
jne 0x40cc9f
xor eax, eax
jmp 0x40cca4
mov eax, 1
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x40cdb0
lea eax, [ebp - 0x148]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov word [ebp - 0x34], 0x44
lea edx, [ebp - 0x148]
lea eax, [ebp - 0x14]
call fcn.004a4ab8
inc dword [ebp - 0x28]
mov edx, str._autoupdate.exe
mov word [ebp - 0x34], 0x38
mov word [ebp - 0x34], 0x50
lea eax, [ebp - 0x18]
call fcn.004a4ab8
inc dword [ebp - 0x28]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004a4c18
dec dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004a4bd4
xor ecx, ecx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 4]
inc dword [ebp - 0x28]
call fcn.004a4e60
lea ecx, [ebp - 0x20]
xor eax, eax
push ecx
lea edx, [ebp - 0x1c]
mov word [ebp - 0x34], 0x5c
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
inc dword [ebp - 0x28]
call fcn.004a4e60
lea eax, [ebp - 0x1c]
pop edx
call fcn.004a4cb8
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004a4bd4
dec dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x40cd9a
push str.autoupdate.exe
call sub.KERNEL32.DLL_GetModuleHandleA
mov word [ebp - 0x34], 0x38
push eax
call fcn.004192fc
pop ecx
mov eax, ebx
call fcn.0044262c
dec dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x34], 8
dec dword [ebp - 0x28]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp - 0x44]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410424
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
mov ebx, eax
mov eax, 0x4acbb0
call fcn.00499b88
mov word [ebp - 0x2c], 8
mov edx, str.SYSVAR
lea eax, [ebp - 4]
call fcn.004a4ab8
inc dword [ebp - 0x20]
lea edx, [ebp - 4]
lea eax, [ebx + 0x10]
call fcn.004a4cb8
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x41053d
mov word [ebp - 0x2c], 0x14
mov edx, str._WINDIR_
lea eax, [ebp - 8]
call fcn.004a4ab8
inc dword [ebp - 0x20]
lea edx, [ebp - 8]
lea esi, [ebx + 4]
mov eax, esi
call fcn.004a4cb8
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x4104c2
push 0x80
lea eax, [ebp - 0xbc]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
jmp 0x410509
mov word [ebp - 0x2c], 0x20
mov edx, str._WINSYSDIR_
lea eax, [ebp - 0xc]
call fcn.004a4ab8
inc dword [ebp - 0x20]
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004a4cb8
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x410509
push 0x80
lea eax, [ebp - 0xbc]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x2c], 0x2c
lea edx, [ebp - 0xbc]
lea eax, [ebp - 0x10]
call fcn.004a4ab8
inc dword [ebp - 0x20]
lea edx, [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.004a4c04
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a4bd4
jmp 0x4105b7
mov word [ebp - 0x2c], 0x38
mov edx, str.REGVAR
lea eax, [ebp - 0x14]
call fcn.004a4ab8
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004a4cb8
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a4bd4
pop ecx
test cl, cl
je 0x4105ac
mov word [ebp - 0x2c], 0x44
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, ebx
inc dword [ebp - 0x20]
mov edx, dword [ebx + 8]
call fcn.004105c8
lea edx, [ebp - 0x18]
lea eax, [ebx + 0xc]
call fcn.004a4c04
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004a4bd4
jmp 0x4105b7
lea edx, [ebx + 8]
lea eax, [ebx + 0xc]
call fcn.004a4c04
mov ecx, dword [ebp - 0x3c]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418ab0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov ebx, eax
mov eax, 0x4b0dc0
call fcn.00499b88
mov word [ebp - 0x18], 0x14
lea edx, [ebx + 0x464]
lea eax, [ebp - 4]
call fcn.004a4af0
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 8
push 1
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x418b28
push 0x10
mov eax, dword [ebp - 4]
test eax, eax
je 0x418b00
mov edx, dword [ebp - 4]
jmp 0x418b05
mov edx, 0x4af471
push edx
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
test esi, esi
je 0x418b22
push 0
push 0
push esi
call sub.ADVAPI32.DLL_StartServiceA
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418b48
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov ebx, eax
mov eax, 0x4b0e00
call fcn.00499b88
mov word [ebp - 0x18], 0x14
lea edx, [ebx + 0x464]
lea eax, [ebp - 4]
call fcn.004a4af0
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 8
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x418bd7
push 0x24
mov eax, dword [ebp - 4]
test eax, eax
je 0x418b9b
mov edx, dword [ebp - 4]
jmp 0x418ba0
mov edx, 0x4af472
push edx
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
test esi, esi
je 0x418bd1
lea eax, [ebp - 0x44]
push eax
push esi
call sub.ADVAPI32.DLL_QueryServiceStatus
mov edx, dword [ebp - 0x40]
cmp edx, 4
jne 0x418bcb
lea ecx, [ebp - 0x44]
push ecx
push 1
push esi
call sub.ADVAPI32.DLL_ControlService
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418dd0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffa8
mov esi, edx
xor ebx, ebx
mov ecx, str.EXPLORER.EXE
mov edx, esp
call fcn.00418e54
test eax, eax
jne 0x418ded
xor eax, eax
jmp 0x418e4c
push 0x44
push 0
lea eax, [esp + 0xc]
push eax
call fcn.004997fc
add esp, 0xc
mov dword [esp + 4], 0x44
mov dword [esp + 0xc], str.winsta0default
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x60
push 0
push 0
push 0
push esi
push 0
mov eax, dword [esp + 0x28]
push eax
call sub.ADVAPI32.DLL_CreateProcessAsUserA
mov esi, eax
call sub.KERNEL32.DLL_GetLastError
mov edx, dword [esp]
push edx
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
je 0x418e4a
mov ebx, 1
mov eax, ebx
add esp, 0x58
pop esi
pop ebx
ret
Function at 0x418e54
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov esi, ecx
mov edi, edx
test esi, esi
jne 0x418e6c
xor eax, eax
jmp 0x418f22
push esi
push edi
mov esi, 0x4aeb8c
lea edi, [esp + 8]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x418e97
xor eax, eax
jmp 0x418f22
mov dword [esp], 0x128
push esp
push ebx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x418f18
lea edx, [esp + 0x24]
push edx
call fcn.0049d1c8
pop ecx
push eax
push esi
call fcn.0049d1c8
pop ecx
mov edx, eax
pop eax
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x418f06
test cl, cl
je 0x418edb
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x418f06
add eax, 2
add edx, 2
test cl, cl
jne 0x418ebf
jne 0x418f06
mov eax, dword [esp + 8]
push eax
push 0
push 0x400
call sub.KERNEL32.DLL_OpenProcess
push edi
push 0xf01ff
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
mov esi, eax
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
jmp 0x418f22
push esp
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x418ea9
mov esi, 1
jmp 0x418f1a
xor esi, esi
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x418f88
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov eax, 0x4b0f90
call fcn.00499b88
mov dword [ebp - 0x1c], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004a4af0
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 8
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x41914a
mov word [ebp - 0x28], 0x14
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
inc dword [ebp - 0x1c]
call fcn.004a4e60
lea edx, [ebp - 8]
lea eax, [ebp + 8]
call fcn.004a4c04
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41900e
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
jmp 0x419010
xor edx, edx
mov dword [ebp - 0x3c], edx
xor eax, eax
mov word [ebp - 0x28], 8
mov word [ebp - 0x28], 0x20
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x164]
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x2c
mov dword [ebp - 0x164], 0x128
push ecx
push esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
setne al
and eax, 1
test al, al
je 0x419134
mov word [ebp - 0x28], 0x38
lea edx, [ebp - 0x140]
lea eax, [ebp - 0xc]
call fcn.004a4ab8
inc dword [ebp - 0x1c]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x1c]
call fcn.00485388
lea eax, [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x14]
inc dword [ebp - 0x1c]
call fcn.004a4e60
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004a4c04
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004a4bd4
dec dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a4bd4
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4190da
mov eax, dword [ebp - 4]
mov ebx, dword [eax - 4]
jmp 0x4190dc
xor ebx, ebx
mov eax, dword [ebp - 0x3c]
cmp ebx, eax
jl 0x4190f1
lea edx, [ebp + 8]
lea eax, [ebp - 4]
call fcn.004a4e3c
dec eax
je 0x419106
mov edx, dword [ebp - 0x3c]
cmp ebx, edx
jge 0x419117
lea edx, [ebp - 4]
lea eax, [ebp + 8]
call fcn.004a4e3c
dec eax
jne 0x419117
push 0x1388
mov ecx, dword [ebp - 0x15c]
push ecx
call fcn.0041d6d0
lea eax, [ebp - 0x164]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
setne al
and eax, 1
test al, al
jne 0x419054
dec dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4bd4
mov word [ebp - 0x28], 8
push esi
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x1c]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4bd4
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret