joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c304
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x44c3a3
cmp dword [ebx + 0x94], 0
jne 0x44c39d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44c28c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44c39d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44c363
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44c39d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00420714
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44c372
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44c5bc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x665bf4]
cmp dword [eax + 0x30], 0
je 0x44c719
test bl, bl
jne 0x44c66a
cmp dword [esi + 0x9c], 0
jne 0x44c65f
mov eax, esi
call fcn.0044ee04
push eax
push 0x44c4e8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x44c630
mov eax, dword [0x665bf4]
call fcn.0044f4e4
test al, al
je 0x44c630
mov eax, dword [0x665c18]
call fcn.00406c70
mov edi, eax
cmp edi, 0
jl 0x44c630
push 0
mov eax, dword [0x665c18]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x44c61a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x44c65f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00420714
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x44c63f
inc dword [esi + 0x9c]
jmp 0x44c719
cmp dword [esi + 0x9c], 0
jle 0x44c719
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x44c719
cmp dword [esi + 0x44], 0
je 0x44c6c5
mov eax, dword [0x665bf4]
call fcn.0044f4e4
test al, al
je 0x44c6c5
mov eax, dword [0x665c18]
call fcn.00406c70
mov edi, eax
cmp edi, 0
jl 0x44c6c5
push 5
mov eax, dword [0x665c18]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x44c6af
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x44c6f4
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00420714
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x44c6d4
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x665c18
mov ecx, 1
mov edx, dword [0x44c4c8]
call fcn.00406e24
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x44d200
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x44d26a
mov eax, ebx
call fcn.0044f4e4
test al, al
jne 0x44d26a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004055bc
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x44d257
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x44d277
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405520
jmp 0x44d277
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405520
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x44e608
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44e676
mov eax, esi
call fcn.00465ce8
test al, al
je 0x44e676
mov eax, dword [ebx + 0x84]
call fcn.00465948
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44e676
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x44e66a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00465948
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0045d75c
jmp 0x44e676
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0044e444
pop esi
pop ebx
ret

Function at 0x4505a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004054cc
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4505ee
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040573c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455814
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455947
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x42e200]
call fcn.0042e36c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x45591d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042e448
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.0040573c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x45595c
call fcn.004057e4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0042e5d4
lea ecx, [ebp - 4]
mov edx, 0x455998
mov eax, dword [ebp - 0xc]
call fcn.0042e84c
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004112a8
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x455900
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4559a4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x659890]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455907
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4559f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x455a3b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455a1e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x455a2f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x455a3b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x45afc4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x665c84], 0
je 0x45b10d
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x660674]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x45b10d
mov eax, dword [0x665c88]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x665c84]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x45b0dc
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x665c84]
call fcn.00420714
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x45b0d4
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x45b0d4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x45b0d4
mov eax, dword [ebp - 0x14]
call fcn.00465948
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b0d4
push ebp
call fcn.0045af80
pop ecx
test al, al
jne 0x45b0d4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404764
test al, al
je 0x45b0d4
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404764
cmp byte [ebp - 1], 0
je 0x45b0d4
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x45b0d4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x665c88]
call fcn.0045a6ec
inc edi
dec ebx
jne 0x45b029
mov eax, dword [0x665c88]
cmp dword [eax + 8], 0
jle 0x45b0f4
mov eax, dword [0x665c88]
call fcn.0045a7a4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x45b10d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0045ade4
pop ecx
test al, al
jne 0x45b10d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46281c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00407d54
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0045d374
test ebx, ebx
jne 0x46286f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00462758
mov ebx, eax
test ebx, ebx
je 0x46295a
cmp esi, ebx
je 0x462898
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4628ad
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4628e5
add eax, 0xffffff5f
sub eax, 2
jb 0x4628fd
dec eax
sub eax, 2
jb 0x462911
dec eax
sub eax, 2
jb 0x462907
jmp 0x46291b
add eax, 0xfffffdff
sub eax, 2
jb 0x4628fd
dec eax
sub eax, 2
jb 0x462911
dec eax
sub eax, 2
jb 0x462907
jmp 0x46291b
mov byte [esp + 0x120], 0
jmp 0x462923
mov byte [esp + 0x120], 2
jmp 0x462923
mov byte [esp + 0x120], 1
jmp 0x462923
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004429fc
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.0045eb7c
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x46295c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x46ade8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x660a7c]
cmp byte [eax + 0xc], 0
je 0x46af55
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46af4e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x665c94], 0
jne 0x46ae3c
push 0x46af5c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x46af64
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665c94], eax
cmp dword [0x6599d8], 0
jne 0x46af37
push 0x46af74
call sub.kernel32.dll_LoadLibraryA
mov dword [0x6599d8], eax
cmp dword [0x6599d8], 0
je 0x46af37
push 0x46af80
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665c98], eax
push 0x46af90
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665c9c], eax
push 0x46afa4
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665ca0], eax
push 0x46afbc
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665ca4], eax
push 0x46afd4
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665ca8], eax
push 0x46afe8
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665cac], eax
push 0x46b000
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665cb0], eax
push 0x46b018
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665cb4], eax
push 0x46b034
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665cb8], eax
push 0x46b040
mov eax, dword [0x6599d8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x665cbc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46af55
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x47a25c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x47a430
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [esi]
call fcn.004648c4
mov eax, dword [esi]
cmp byte [eax + 0x258], 0
je 0x47a415
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi]
sub eax, dword [edx + 0x268]
mov edx, dword [esi]
cmp eax, dword [edx + 0x2c0]
jb 0x47a2c2
mov eax, dword [esi]
add eax, 0x264
call fcn.004054cc
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi]
mov dword [edx + 0x268], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 8
je 0x47a39c
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [0x660a44]
movzx eax, al
bt dword [edx], eax
jae 0x47a359
push 1
push 0x102
push 0x102
mov eax, dword [esi]
call fcn.00465948
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x47a3e0
mov eax, dword [esi]
push dword [eax + 0x264]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004056b4
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.004056b4
push dword [ebp - 0x2c]
mov eax, dword [esi]
add eax, 0x264
mov edx, 3
call fcn.00405860
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x47a3e0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
movzx edx, byte [edx]
call fcn.004056b4
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
add eax, 0x264
call fcn.00405798
jmp 0x47a3e0
mov eax, dword [esi]
mov ebx, dword [eax + 0x264]
test ebx, ebx
je 0x47a389
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
add eax, 0x264
mov ecx, 1
mov edx, ebx
call fcn.00405a04
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.0040578c
mov edx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
call fcn.0040fbf8
cmp al, 2
je 0x47a378
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x47a3cd
sub eax, 4
mov eax, dword [eax]
mov edx, dword [esi]
add edx, 0x264
mov ecx, 1
xchg edx, eax
call fcn.00405a04
mov eax, dword [esi]
mov eax, dword [eax + 0x264]
test eax, eax
je 0x47a3f1
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47a3fe
push ebp
call fcn.0047a174
pop ecx
jmp 0x47a415
xor edx, edx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xe0]
mov eax, dword [esi]
mov si, 0xffeb
call fcn.00404764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a437
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004054f0
ret
Function at 0x47af10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040594c
xor eax, eax
push ebp
push 0x47b045
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x47b018
xor edx, edx
push ebp
push 0x47b011
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x47af5d
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47afe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x47afd5
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x47af9c
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040595c
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004032a4
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47afdc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x660054]
mov dl, 1
mov eax, dword [0x4091b4]
call fcn.0040f290
call fcn.00404e1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b04c
lea eax, [ebp - 4]
call fcn.004054cc
ret
Function at 0x47b054
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b20f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405c50
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47b228
call fcn.004057e4
mov eax, ebx
call fcn.0042a588
mov edi, eax
dec edi
test edi, edi
jl 0x47b10c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042a55c
mov edx, dword [0x472694]
call fcn.004046f4
test al, al
je 0x47b108
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.0042a55c
lea edx, [ebp - 0x14]
call fcn.0045d83c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405c50
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405860
inc esi
dec edi
jne 0x47b0ba
movzx eax, byte [0x47b22c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x47b238
mov eax, dword [ebp - 8]
call fcn.004105e8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00405564
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045d83c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x47b228
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0045d83c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x47b228
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x47b228
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x47b244
call fcn.0040bc98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b216
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004054f0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004054f0
lea eax, [ebp - 0x14]
call fcn.004054cc
lea eax, [ebp - 0x10]
call fcn.004054cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004054f0
ret
Function at 0x47cda4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040594c
xor eax, eax
push ebp
push 0x47ce22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040595c
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x47cded
mov eax, dword [ebx + 4]
call fcn.0040595c
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ce29
lea eax, [ebp - 4]
call fcn.004054cc
ret

Function at 0x47dec4
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47e069
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403500
cmp word [ebx + 0xa2], 0
je 0x47df0d
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x47df21
lea esi, [ebp - 0xc]
jmp 0x47df23
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x47df30
xor edi, edi
jmp 0x47df3d
mov eax, dword [ebx + 0x80]
call fcn.0040595c
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.0040595c
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0047d574
mov eax, dword [ebp - 0x14]
call fcn.0040595c
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.0040595c
push eax
mov eax, dword [ebp - 4]
call fcn.0040595c
push eax
mov eax, ebx
call fcn.0047d6b4
push eax
mov eax, ebx
call fcn.0047d688
push eax
mov eax, ebx
call fcn.0047d640
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0047d440
mov eax, dword [ebp - 0x18]
call fcn.0040595c
push eax
mov eax, dword [ebx + 8]
call fcn.0040595c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x47dfc6
call fcn.00410ab0
xor edx, edx
push ebp
push 0x47e03f
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x47e004
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x47dffa
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e046
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x47e078
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x47e0a4
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040595c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47e0c9
call fcn.00410ab0
xor eax, eax
push ebp
push 0x47e100
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x47e0e9
call fcn.00410ab0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e107
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x480370
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4803c1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4803a8
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x480398
jmp 0x4803c1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4803a9
pop ebx
mov esp, ebp
pop ebp
ret