joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab86c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aba77
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x4eef54
cmp esi, 0xa
jge 0x4ab8b0
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4aba90
call fcn.0040a510
jmp 0x4ab8ca
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4abaac
call fcn.0040a510
mov eax, dword [ebp - 4]
call fcn.004049c8
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenMutexA
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x4ab8fb
mov eax, dword [ebp - 4]
call fcn.004049c8
push eax
push 0
push 0
call fcn.00406d38
mov dword [ebx], eax
inc esi
add ebx, 0x114
cmp esi, 0x20
jne 0x4ab88f
push 0x4ababc
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e8970], eax
cmp dword [0x4e8970], 0
je 0x4ab973
push 0x4abacc
mov eax, dword [0x4e8970]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10ec], eax
push 0x4abaec
mov eax, dword [0x4e8970]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10f0], eax
push 0x4abb10
mov eax, dword [0x4e8970]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10f4], eax
push 0x4abb2c
mov eax, dword [0x4e8970]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10f8], eax
push 0x4abb44
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e896c], eax
cmp dword [0x4e896c], 0
je 0x4aba61
push 0x4abb4c
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10c4], eax
push 0x4abb64
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10c8], eax
push 0x4abb74
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10cc], eax
push 0x4abb8c
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10d0], eax
push 0x4abb9c
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10d4], eax
push 0x4abbac
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10d8], eax
push 0x4abbbc
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10dc], eax
push 0x4abbd8
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10e0], eax
push 0x4abbf0
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10e4], eax
push 0x4abc04
mov eax, dword [0x4e896c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f10e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aba7e
lea eax, [ebp - 4]
call fcn.00404508
ret
Function at 0x4b2150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b21c8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ebx, eax
push esi
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404778
mov eax, dword [ebp - 0x10c]
mov ecx, ebx
mov edx, 1
call fcn.00404a28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b21cf
lea eax, [ebp - 0x10c]
call fcn.00404508
ret

Function at 0x4b21d8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4b21e1
mov eax, dword [esp + 0x4000]
add esp, 0xffffffbc
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov edx, esp
xchg edx, eax
call fcn.00409ecc
lea eax, [esp + 0x2001]
mov edx, edi
call fcn.00409ecc
mov dword [esp + 0x4004], 0x44
xor eax, eax
mov dword [esp + 0x4008], eax
xor eax, eax
mov dword [esp + 0x400c], eax
mov eax, esp
mov dword [esp + 0x4010], eax
xor eax, eax
mov dword [esp + 0x402c], eax
mov word [esp + 0x4036], 0
xor eax, eax
mov dword [esp + 0x4038], eax
mov dword [esp + 0x4030], 1
mov word [esp + 0x4034], 5
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
push esi
lea eax, [esp + 0x4008]
push eax
lea eax, [esp + 0x2009]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b22a8
mov bl, 1
mov eax, ebx
add esp, 0x4048
pop edi
pop esi
pop ebx
ret

Function at 0x4b22b4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4b22be
mov eax, dword [esp + 0x4000]
add esp, 0xffffffbc
mov edi, ecx
mov ebp, edx
mov esi, eax
xor ebx, ebx
mov eax, esp
mov edx, esi
call fcn.00409ecc
lea eax, [esp + 0x2001]
mov edx, esi
call fcn.00409ecc
mov dword [esp + 0x4004], 0x44
xor eax, eax
mov dword [esp + 0x4008], eax
xor eax, eax
mov dword [esp + 0x400c], eax
mov eax, esp
mov dword [esp + 0x4010], eax
xor eax, eax
mov dword [esp + 0x402c], eax
mov word [esp + 0x4036], 0
xor eax, eax
mov dword [esp + 0x4038], eax
mov dword [esp + 0x4030], 1
mov word [esp + 0x4034], 5
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
push edi
lea eax, [esp + 0x4008]
push eax
mov eax, ebp
call fcn.004049c8
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4b2396
mov bl, 1
jmp 0x4b2396
mov eax, dword [0x4ed204]
mov eax, dword [eax]
call fcn.0047c840
mov eax, edi
call fcn.004b23b0
test al, al
jne 0x4b238a
mov eax, ebx
add esp, 0x4048
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b23e8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
mov eax, dword [ebp - 8]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4b25a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43ae6c]
call fcn.0043af6c
mov dword [ebp - 0x14], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.0043b00c
xor eax, eax
push ebp
push 0x4b2579
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x4b25bc
mov eax, dword [ebp - 0x14]
call fcn.0043b074
test al, al
je 0x4b2563
xor eax, eax
mov al, bl
cmp eax, 4
ja case.default.0x4b2470
jmp dword [eax*4 + 0x4b2477]
lea ecx, [ebp - 0xc]
mov edx, 0x4b2608
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b2618
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b262c
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b2640
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0x18]
mov edx, 0x4b2650
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x4b2660
call fcn.00404814
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004b20dc
push dword [ebp - 0x1c]
push dword [ebp - 8]
push 0x4b2694
push dword [ebp - 4]
push 0x4b26a0
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404888
mov eax, dword [ebp - 0x10]
call fcn.004096f0
test al, al
je 0x4b2563
push 0x80
mov eax, dword [ebp - 0x10]
call fcn.004049c8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0x10]
call fcn.004099e4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004b20dc
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.004047d0
mov eax, dword [ebp - 0x20]
call fcn.00409df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2580
mov eax, dword [ebp - 0x14]
call fcn.00403614
ret
Function at 0x4b24d3
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
mov eax, dword [ebp - 8]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4b25a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43ae6c]
call fcn.0043af6c
mov dword [ebp - 0x14], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.0043b00c
xor eax, eax
push ebp
push 0x4b2579
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x4b25bc
mov eax, dword [ebp - 0x14]
call fcn.0043b074
test al, al
je 0x4b2563
xor eax, eax
mov al, bl
cmp eax, 4
ja case.default.0x4b2470
jmp dword [eax*4 + 0x4b2477]
lea ecx, [ebp - 0xc]
mov edx, 0x4b2608
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b2618
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b262c
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0xc]
mov edx, 0x4b2640
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
jmp case.default.0x4b2470
lea ecx, [ebp - 0x18]
mov edx, 0x4b2650
mov eax, dword [ebp - 0x14]
call fcn.0043b43c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x4b2660
call fcn.00404814
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004b20dc
push dword [ebp - 0x1c]
push dword [ebp - 8]
push 0x4b2694
push dword [ebp - 4]
push 0x4b26a0
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00404888
mov eax, dword [ebp - 0x10]
call fcn.004096f0
test al, al
je 0x4b2563
push 0x80
mov eax, dword [ebp - 0x10]
call fcn.004049c8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0x10]
call fcn.004099e4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004b20dc
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.004047d0
mov eax, dword [ebp - 0x20]
call fcn.00409df0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2580
mov eax, dword [ebp - 0x14]
call fcn.00403614
ret
Function at 0x4cc9ec
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4cca6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004049c8
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4cca35
mov eax, dword [ebx + 4]
call fcn.004049c8
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cca71
lea eax, [ebp - 4]
call fcn.00404508
ret

Function at 0x4cda3c
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cdbd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402cf0
cmp word [ebx + 0xa2], 0
je 0x4cda85
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4cda99
lea esi, [ebp - 8]
jmp 0x4cda9b
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4cdaa8
xor edi, edi
jmp 0x4cdab5
mov eax, dword [ebx + 0x80]
call fcn.004049c8
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.004049c8
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004cd1a4
mov eax, dword [ebp - 0x14]
call fcn.004049c8
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.004049c8
push eax
mov eax, dword [ebp - 0x10]
call fcn.004049c8
push eax
mov eax, ebx
call fcn.004cd2d8
push eax
mov eax, ebx
call fcn.004cd2ac
push eax
mov eax, ebx
call fcn.004cd260
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004cd070
mov eax, dword [ebp - 0x18]
call fcn.004049c8
push eax
mov eax, dword [ebx + 8]
call fcn.004049c8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4cdb3e
call fcn.0040e7ac
xor edx, edx
push ebp
push 0x4cdbb7
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4cdb7c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4cdb72
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cdba0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdbbe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4cdbe8
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4cdc14
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004049c8
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4cdc39
call fcn.0040e7ac
xor eax, eax
push ebp
push 0x4cdc70
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4cdc59
call fcn.0040e7ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdc77
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x4ce610
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4ce708
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004049c8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ce6eb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4ce6d4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 1
je 0x4ce6d4
cmp word [ebp + 0xa], 0
je 0x4ce684
mov eax, 0x4ce720
call fcn.00436d30
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
mov ebx, 0xb5
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 1
je 0x4ce6b8
mov eax, 1
call fcn.004ce5e8
dec ebx
jne 0x4ce698
cmp dword [ebp - 0x20], 1
je 0x4ce6d4
mov ecx, 0x4ce738
mov dl, 1
mov eax, dword [0x407ef4]
call fcn.0040cf24
call fcn.00403ea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce6f2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4ce748
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4ce885
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.004049c8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ce868
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4ce851
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 1
je 0x4ce810
cmp word [ebp + 0xa], 0
je 0x4ce7c0
mov eax, 0x4ce89c
call fcn.00436d30
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_ControlService
mov ebx, 0xb5
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp dword [ebp - 0x20], 1
je 0x4ce7f4
mov eax, 1
call fcn.004ce5e8
dec ebx
jne 0x4ce7d4
cmp dword [ebp - 0x20], 1
je 0x4ce810
mov ecx, 0x4ce8b4
mov dl, 1
mov eax, dword [0x407ef4]
call fcn.0040cf24
call fcn.00403ea4
cmp word [ebp + 0xa], 0
je 0x4ce822
mov edx, 0x4ce8cc
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
je 0x4ce83b
mov eax, 1
call fcn.004ce5e8
jmp 0x4ce851
mov ecx, 0x4ce8e4
mov dl, 1
mov eax, dword [0x407ef4]
call fcn.0040cf24
call fcn.00403ea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce86f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4cea44
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4cebb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ce934
mov dword [ebp - 0xc], eax
push 6
call fcn.00406400
pop ecx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4ceb94
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x208
call fcn.00406400
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x208
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
xor edx, edx
push edx
push eax
mov eax, dword [0x4e9818]
cdq
cmp edx, dword [esp + 4]
jne 0x4ceac7
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4ceae5
mov eax, dword [ebp - 0x10]
call fcn.0040283c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00406400
pop ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x4ceb56
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0x4ceb04
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4ceb0b
mov dword [ebp - 8], 0xffffffff
test ebx, ebx
je 0x4ceb56
push 0
push 5
mov eax, dword [ebx + 0x190]
dec eax
xor edx, edx
push edx
push eax
call fcn.00431668
xor eax, eax
mov dl, byte [ebx + eax + 0x194]
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
inc eax
cmp eax, 6
jne 0x4ceb25
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004cea18
test eax, eax
jle 0x4ceb50
mov dword [ebp - 8], 1
jmp 0x4ceb56
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4ceb0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ceb9b
cmp dword [ebp - 0x10], 0
je 0x4ceb73
mov eax, dword [ebp - 0x10]
push eax
call fcn.00406410
pop ecx
cmp dword [ebp - 0xc], 0
je 0x4ceb83
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406410
pop ecx
cmp dword [ebp - 0x18], 0
je 0x4ceb93
mov eax, dword [ebp - 0x18]
push eax
call fcn.00406410
pop ecx
ret

Function at 0x4d0d94
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4d0df2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.004d0e70
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4d0dda
lea eax, [ebp - 4]
call fcn.004d0e70
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4d0ddc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0df9
lea eax, [ebp - 4]
call fcn.00404508
ret
Function at 0x4d0e00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4d0e64
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.004d0e70
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040a020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0e6b
lea eax, [ebp - 4]
call fcn.00404508
ret

Function at 0x4d145c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004049b8
xor eax, eax
push ebp
push 0x4d1555
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004d0b38
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409c2c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004d1e1c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409b10
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004d1e90
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d155c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040452c
ret