joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47628a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x476378
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x47632e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x476311
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xfffffff7
jmp 0x47632c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x47632c
push 0x1076
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x476376
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push 0x4f1a
push 0x2f50
push 0x76bb
push dword [ebp - 0x3c]
push 0x7972
push dword [ebp - 0x40]
push 1
push 0x2880
push 0x3c30
push 0x4b70
push 1
push 0x6d29
push 1
call fcn.00446a32
add esp, 0x34
jmp 0x47639c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
push 0x3813
push dword [ebp - 0x44]
push 1
push 0
push 0x757d
push 0x4ca3
call fcn.0043639a
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x4763a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4763d1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 1
push dword [ebp - 0xc]
call fcn.0047646a
add esp, 0x10
jmp 0x476466
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x476455
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x476433
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x1e
push 0x56fc
push 0
push 1
push 0x5860
push 0x1930
push 1
push 0
push 0x547f
call fcn.00437a94
add esp, 0x28
jmp 0x476453
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x476453
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x476466
push 0
push 0x607a
push 1
call fcn.004366ef
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4764a5
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x476552
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4764f7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.004765b9
add esp, 0xc
jmp 0x476550
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x47652b
mov byte [ebp - 1], 0
push 1
push 0x7792
lea eax, [ebp - 1]
push eax
push 1
push 1
push 0x6906
push 1
call fcn.0043cf40
add esp, 0x1c
jmp 0x476550
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x740
push 0x22c5
push 0x194d
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4765b5
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push 0x687a
push 1
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
push eax
push 0x6315
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x17fc
push 0x50f9
call fcn.0044ccd9
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x476f56
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x476fe0
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x476fa9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
push 0x7ba3
push dword [ebp - 0x18]
call fcn.00477086
add esp, 0x10
jmp 0x476fdb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0x6242
push dword [ebp - 0x20]
push 0xd57
push 0x22e7
push 0x71ce
push 1
push 1
push 1
push 0x5fa3
push 0
call fcn.0044f1d2
add esp, 0x28
jmp 0x477082
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x477057
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x47703e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x47703c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x477055
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x477082
push 0
push 0x99c
push 1
push 0x5d84
push 1
push 0x464b
push 1
push 0x1a6e
push 1
push 0x1fd3
call fcn.00442e2b
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x4773f6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x477480
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0x21f5
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 1
push 0x32ee
push 0x7cd6
push 0x595a
push 0x7724
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x457c
push 0x4fc0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x1de1
push dword [ebp - 0x20]
call fcn.004775a2
add esp, 0x44
jmp 0x47759e
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x47755f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x477541
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4774ea
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffe2
jl 0x47753f
mov dword [ebp - 0x40], 1
push 0
push 0x25a7
push 0x5250
push 1
lea eax, [ebp - 0x40]
push eax
push 1
push 0x6251
push 1
push 1
push dword [ebp - 4]
call fcn.00445d7a
add esp, 0x28
push 1
push 0
push 0x4936
push 0x9da
push 1
push 1
push 1
call fcn.0044ac7f
add esp, 0x1c
jmp 0x4774df
jmp 0x47755d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x47755d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x47759e
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x47758f
push 0x26f8
push 0x21c2
push 0
push 0
push 0xe00
push 0x140
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x47759e
push 0
push 0x2529
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov esp, ebp
pop ebp
ret
Function at 0x48c76b
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x48c7b3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
push 0x688a
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push dword [ebp - 8]
push 0x5da6
push 0x7fa4
push dword [ebp - 0xc]
call fcn.0048d207
add esp, 0x1c
jmp 0x48c814
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x48c7e9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x18]
push 0x1ec5
call fcn.0048c74a
add esp, 0xc
jmp 0x48c814
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x48c805
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x48c814
push 0
push 0x8ef
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov esp, ebp
pop ebp
ret

Function at 0x48cb7f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x48cc0c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x48cbc3
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0
call fcn.0049570b
pop ecx
pop ecx
jmp 0x48cc0a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x48cbe3
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
jmp 0x48cc0a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x48cc0a
push 0x4ca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x48cc3b
push 0x2dc4
push 0x6b13
push 0x1ab4
push 0x695f
push 0x4962
push 0
push 1
push 0xc15
push 0x77f8
call fcn.004919f7
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x48ce9b
Capabilities:
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x48cf57
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x48cf27
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x48cef4
push 0x35e
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp 0x48cf25
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x48cf25
push 0x112f
push 0
push 0x26a6
push 0x4cf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x48cf55
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x48cf48
push 0x1076
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x48cf55
push 0x200a
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x48cf78
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push 0x3948
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0
call fcn.0048d0f6
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x48e1f4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x48e295
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x48e270
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x48e25d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x48e26e
push 0
push 0x8bb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x48e293
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 0x46c3
push dword [ebp - 0x28]
push 1
push 0
push dword [ebp - 0x2c]
call fcn.0048e074
add esp, 0x14
jmp 0x48e2b5
push 0
push 1
push 0x499f
push 0x7b01
push 0x2678
push 0x4a18
call fcn.0049794c
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x48e73a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x48e7f0
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x48e7b0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x48e78e
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x48e7ae
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x48e7ae
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x48e7ee
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x48e7da
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x48e7d8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x48e7ee
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x48e7ee
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x48e808
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push 0
push 0x1d76
push dword [ebp - 0x2c]
call fcn.0048ffbb
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x48eeb3
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x48ef74
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x48ef44
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x48ef3a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x48ef38
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x740
push 0x22c5
push 0x194d
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x48ef42
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x48ef72
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x48ef63
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x48ef72
push 0
push 0x2529
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x48efdf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x48efa6
push 1
call fcn.0048e8e5
pop ecx
jmp 0x48efdf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push 0x7d8b
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 1
push 0x26
push dword [ebp - 0x48]
push 0
push 1
call fcn.0048dfb0
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x48f63f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x48f681
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x48f668
push 0
call fcn.00496a74
pop ecx
jmp 0x48f67c
push 0x2cd3
push 0x48bf
push 0
call fcn.00497289
add esp, 0xc
jmp 0x48f75e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x48f6e8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x48f6d2
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
call fcn.0048f9a6
pop ecx
pop ecx
jmp 0x48f6e6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x48f6e6
push 0
call fcn.00495b34
pop ecx
jmp 0x48f75e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x48f740
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
call fcn.004b6f01
mov esi, eax
mov ecx, dword [ebp - 0x3c]
call fcn.00403788
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x40]
mov dword [eax], edx
jmp 0x48f75e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x48f75e
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4905a7
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4905f1
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x6f22
push dword [ebp - 0x10]
call fcn.0049067b
add esp, 0x18
jmp 0x490677
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x490637
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.004936f7
add esp, 0xc
jmp 0x490677
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x49066d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x49066b
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x490677
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret