joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452204
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.USER32.dll_GetClassNameA
lea eax, [ebp - 0x100]
mov edx, 0x5d245b
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x452276
test cl, cl
je 0x45224e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x452276
add eax, 2
add edx, 2
test cl, cl
jne 0x452232
jne 0x452276
mov eax, ebx
push 0
push 0x5d2468
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, ebx
push 0
push 0x5d2471
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
lea eax, [ebp - 0x100]
mov edx, 0x5d2476
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4522b2
test cl, cl
je 0x45229d
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4522b2
add eax, 2
add edx, 2
test cl, cl
jne 0x452281
jne 0x4522b2
mov eax, ebx
push 0
push 0x5d247f
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4522d5
test esi, esi
je 0x4522c0
mov byte [esi], 0
push esi
push 0x200
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x452327
push ebx
call fcn.004521fc
pop ecx
push esi
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
push ebx
push ebx
call sub.USER32.dll_GetDlgCtrlID
and ax, 0xffff
movzx edx, ax
or edx, 0x3000000
push edx
push 0x111
push ebx
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
push 0
call sub.KERNEL32.dll_Sleep
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov ecx, 0xa
push ebx
push esi
push edi
lea edi, [ebp - 0x2c]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push esi
mov esi, 0x51a5f8
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
test ebx, ebx
jne 0x4526bd
xor eax, eax
jmp 0x45284c
mov edx, dword [ebp + 0xc]
dec edx
je 0x4526d5
dec edx
je 0x4526ef
dec edx
je 0x452705
dec edx
je 0x45277f
jmp 0x4527f4
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x4527f8
xor eax, eax
jmp 0x45284c
push ebx
call fcn.00445ac4
pop ecx
test eax, eax
je 0x4527f8
xor eax, eax
jmp 0x45284c
push 1
push 0x104
push ebx
lea edx, [ebp - 0x2c]
push 0x5d2484
push edx
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x452731
mov cl, byte [ebx]
test cl, cl
jne 0x4527f8
push 0x5d2494
call fcn.004d8ac4
pop ecx
mov edi, eax
test edi, edi
jne 0x45275a
push esi
mov esi, 0x5d24a1
mov edi, ebx
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4527f8
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4527f8
push 1
push 0x104
push ebx
lea eax, [ebp - 0x2c]
push 0x5d24b2
push eax
push 0x80000002
call fcn.00406a20
add esp, 0x18
test eax, eax
je 0x4527a7
mov dl, byte [ebx]
test dl, dl
jne 0x4527f8
push 0x5d24c8
call fcn.004d8ac4
pop ecx
mov edi, eax
test edi, edi
jne 0x4527cf
push esi
mov esi, 0x5d24da
mov edi, ebx
mov eax, edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4527f8
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x4527f8
xor eax, eax
jmp 0x45284c
mov dl, byte [ebx]
test dl, dl
jne 0x452802
xor eax, eax
jmp 0x45284c
test esi, 0x100
je 0x452834
push ebx
call fcn.004cd3e4
pop ecx
test eax, eax
je 0x452834
push ebx
call fcn.004cd3e4
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x452834
push 0x5d24f1
push ebx
call fcn.004cd308
add esp, 8
test esi, 0x200
je 0x45284a
push 0x5d24f3
push ebx
call fcn.004cd308
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456000
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ax, word [0x51a937]
mov word [ebp - 3], ax
mov al, byte [0x51a939]
mov byte [ebp - 1], al
lea edx, [ebp - 3]
push edx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jne 0x456061
test ebx, ebx
jne 0x456060
test esi, esi
je 0x456059
xor eax, eax
push esi
lea edi, [ebp - 3]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, 1
jmp 0x45607b
dec ebx
dec byte [ebp - 3]
movsx eax, byte [ebp - 3]
cmp eax, 0x43
je 0x456072
cmp eax, 0x63
jne 0x456021
test esi, esi
je 0x456079
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x457fcc
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov eax, 0x51ab8d
call fcn.004cfcb8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xffffff9c
mov word [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push eax
push 0
push 2
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call sub.ADVAPI32.dll_LogonUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x458040
test ebx, ebx
je 0x458154
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d3226
push ebx
call fcn.004d1ac0
add esp, 0xc
jmp 0x458154
mov edx, dword [ebp - 0x28]
push edx
call fcn.00457ec0
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x458075
test ebx, ebx
je 0x458154
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d322f
push ebx
call fcn.004d1ac0
add esp, 0xc
jmp 0x458154
push 0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
push edx
push esi
call fcn.00445740
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4580b7
test ebx, ebx
je 0x458154
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0x5d3238
push ebx
call fcn.004d1ac0
add esp, 0x10
jmp 0x458154
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call fcn.004cd264
add esp, 0xc
mov dword [ebp - 0x74], 0x44
test byte [ebp + 0x21], 1
je 0x4580db
mov dword [ebp - 0x6c], 0x5d3244
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x74]
push ecx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call sub.ADVAPI32.dll_CreateProcessAsUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45812c
mov dword [ebp - 0x30], 0xffffff3b
test ebx, ebx
je 0x458154
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5d3266
push ebx
call fcn.004d1ac0
add esp, 0xc
jmp 0x458154
mov edx, dword [ebp - 0x80]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x84]
push ecx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4581aa
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00445764
add esp, 0xc
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x458176
mov ecx, dword [ebp - 0x28]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov word [ebp - 0x14], 0
jmp 0x45819d
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x88]
pop ebp
ret
Function at 0x45c6ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0045c640
mov esi, eax
push esi
push ebx
push 0x5d430d
lea eax, [ebp - 0x24]
push eax
call fcn.004d1ac0
add esp, 0x10
test byte [0x514ff1], 4
je 0x45c6f1
lea edx, [ebp - 0x24]
push edx
push 0x5d4317
push 0x514ff4
call fcn.00451068
add esp, 0xc
push ebx
push 0x5d4323
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d1ac0
add esp, 0xc
test ebx, 0x10000
je 0x45c740
push 0xa1
call sub.USER32.dll_GetAsyncKeyState
test ax, ax
je 0x45c740
and ebx, 0xfffeffff
test byte [0x514ff1], 4
je 0x45c740
push 0x5d4332
push 0x5d4326
push 0x514ff4
call fcn.00451068
add esp, 0xc
test esi, 0x80000
je 0x45c8a4
test bl, 2
jne 0x45c8a4
test esi, 0x10000
je 0x45c7b1
and ebx, 0xffff1fff
lea eax, [ebp - 0x24]
or ebx, 0x4000
push ebx
push 0x5d433f
push eax
call fcn.004d1ac0
add esp, 0xc
test byte [0x514ff1], 4
je 0x45c79a
lea edx, [ebp - 0x24]
push edx
push 0x5d4342
push 0x514ff4
call fcn.00451068
add esp, 0xc
push ebx
push 0x5d4351
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d1ac0
add esp, 0xc
jmp 0x45c8a4
push 0x13
call fcn.0045bf14
pop ecx
call fcn.0045bb24
call fcn.0048461c
call fcn.0047599c
call fcn.0045bb2c
test bh, 0x40
jne 0x45c826
test bh, 8
jne 0x45c826
and ebx, 0xfffff8ff
lea eax, [ebp - 0x24]
or ebx, 0x400
push ebx
push 0x5d4354
push eax
call fcn.004d1ac0
add esp, 0xc
test byte [0x514ff1], 4
je 0x45c814
lea edx, [ebp - 0x24]
push edx
push 0x5d4357
push 0x514ff4
call fcn.00451068
add esp, 0xc
push ebx
push 0x5d4367
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d1ac0
add esp, 0xc
test bh, 2
je 0x45c850
test esi, 0x200
jne 0x45c8a4
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x29
call fcn.00462774
add esp, 0x1c
jmp 0x45c96a
test bh, 4
je 0x45c87a
test esi, 0x400
jne 0x45c8a4
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0x29
call fcn.00462650
add esp, 0x1c
jmp 0x45c96a
test bh, 1
je 0x45c8a4
test esi, 0x100
jne 0x45c8a4
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x29
call fcn.00462564
add esp, 0x1c
jmp 0x45c96a
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b9
call fcn.00462650
xor eax, eax
add esp, 0x1c
xor edi, edi
mov dword [ebp - 4], eax
test bl, 1
je 0x45c8cc
or edi, 1
test bh, 0x40
je 0x45c8d9
or edi, 0x100
jmp 0x45c917
test bh, 0x80
je 0x45c8e6
or edi, 0x200
jmp 0x45c917
test bh, 0x20
je 0x45c902
or edi, 0x10
mov eax, dword [0x519f64]
cmp eax, 0xffffff
je 0x45c917
mov dword [ebp - 4], eax
or edi, 0x40
jmp 0x45c917
or edi, 0x20
mov eax, dword [0x519f60]
cmp eax, 0xffffff
je 0x45c917
mov dword [ebp - 4], eax
or edi, 0x40
test esi, 0x400
je 0x45c925
or edi, 0x1000
push edi
push esi
push ebx
push 0x5d436a
lea edx, [ebp - 0x24]
push edx
call fcn.004d1ac0
add esp, 0x14
test byte [0x514ff1], 4
je 0x45c958
lea ecx, [ebp - 0x24]
push ecx
push 0x5d437b
push 0x514ff4
call fcn.00451068
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push edi
call fcn.00455774
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
mov eax, 0x51b118
push ebx
push esi
push edi
call fcn.004cfcb8
mov word [ebp - 0x14], 8
mov dl, byte [0x518699]
test dl, dl
je 0x45d6db
test byte [0x514ff1], 4
je 0x45d6b6
push 0x5d4663
push 0x5d464f
push 0x514ff4
call fcn.00451068
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0xc
call fcn.00462564
add esp, 0x1c
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x45d771
test byte [0x514ff1], 4
je 0x45d6fb
push 0x5d4676
push 0x5d4664
push 0x514ff4
call fcn.00451068
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x424]
push eax
call fcn.004410b8
add esp, 0xc
test eax, eax
jle 0x45d73b
lea edx, [ebp - 0x424]
lea ecx, [ebp - 0x824]
push edx
push 0x5d4677
push ecx
call fcn.004d1ac0
add esp, 0xc
push 5
lea eax, [ebp - 0x824]
push eax
call sub.KERNEL32.dll_WinExec
mov word [ebp - 0x14], 0
jmp 0x45d762
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x830]
mov esi, dword [ebp - 0x82c]
mov ebx, dword [ebp - 0x828]
pop ebp
ret
Function at 0x45d800
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov eax, 0x51b12c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004cfcb8
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x45d854
test byte [0x514ff1], 4
je 0x45d843
push 0x5d46b6
push 0x5d46aa
push 0x514ff4
call fcn.00451068
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45da0e
mov cl, byte [ebx]
test cl, cl
jne 0x45d88e
test byte [0x514ff1], 4
je 0x45d87a
push 0x5d46c7
push 0x5d46bb
push 0x514ff4
call fcn.00451068
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45da0e
mov cl, byte [0x518699]
test cl, cl
je 0x45d8d8
test byte [0x514ff1], 4
je 0x45d8b4
push ebx
push 0x5d46ca
push 0x514ff4
call fcn.00451068
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push ebx
push 0xb
call fcn.00462564
add esp, 0x1c
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45da0e
test byte [0x514ff1], 4
je 0x45d8f4
push ebx
push 0x5d46d8
push 0x514ff4
call fcn.00451068
add esp, 0xc
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp - 0x128]
cmp eax, 0x30
jne 0x45d936
mov dl, byte [ebp - 0x127]
test dl, dl
jne 0x45d936
mov byte [ebp - 0x128], 0
movsx ecx, byte [ebp - 0x128]
cmp ecx, 0xffffffac
jne 0x45d949
mov byte [ebp - 0x128], 0
push 1
push 0x5d4709
push 0x5d46fa
push 0x5d46e4
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 1
push 0x5d472f
push 0x5d4721
push 0x5d470b
push 0x80000001
call fcn.00406a5c
add esp, 0x14
lea eax, [ebp - 0x128]
push 1
push eax
push 0x5d4747
push 0x5d4731
push 0x80000001
call fcn.00406a5c
add esp, 0x14
push 3
lea edx, [ebp - 0x128]
push edx
push 0
push 0x14
call sub.USER32.dll_SystemParametersInfoA
test eax, eax
je 0x45d9db
push 1
push 0
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.USER32.dll_InvalidateRect
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45da0e
mov word [ebp - 0x14], 0
jmp 0x45da02
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x134]
mov esi, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x12c]
pop ebp
ret
Function at 0x45e750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaec
push esi
push edi
mov esi, 0x51b1e0
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x51b2e4
lea edi, [ebp - 0x208]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x51b3e8
lea edi, [ebp - 0x30c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x51b4ec
lea edi, [ebp - 0x410]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x51b5f0
lea edi, [ebp - 0x514]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x45e7de
mov esi, 0x5d49ac
lea edi, [ebp - 0x104]
mov eax, edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x104]
test edx, edx
je 0x45e827
lea ecx, [ebp - 0x104]
push ecx
call fcn.004cd3e4
pop ecx
test eax, eax
je 0x45e827
lea eax, [ebp - 0x104]
push eax
call fcn.004cd3e4
pop ecx
movsx edx, byte [ebp + eax - 0x105]
cmp edx, 0x5c
je 0x45e827
push 0x5d49c0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004cd308
add esp, 8
push 0x5d49c2
lea eax, [ebp - 0x104]
push eax
call fcn.004cd308
add esp, 8
push 0x2100
lea edx, [ebp - 0x104]
push edx
call fcn.00405b9c
add esp, 8
test eax, eax
jne 0x45e85a
xor eax, eax
jmp 0x45e924
test byte [ebp + 8], 1
je 0x45e86a
mov eax, 1
jmp 0x45e924
mov byte [ebp - 0x30c], 0
mov dl, byte [0x518699]
test dl, dl
jne 0x45e88e
mov cl, byte [0x51869d]
test cl, cl
jne 0x45e88e
mov al, byte [0x51869f]
test al, al
je 0x45e90c
lea edx, [ebp - 0x208]
push edx
push 0x1faf
call fcn.0044f8f8
add esp, 8
lea ecx, [ebp - 0x30c]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.00439938
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0x1fb0
call fcn.0044f8f8
add esp, 8
lea ecx, [ebp - 0x514]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.00439938
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0x1fb1
call fcn.0044f8f8
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.00439938
add esp, 8
push 0x10100
push 0
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.0045f7b8
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45f814
Capabilities:
Persist via run registry key

Disassembly:
push ebx
add esp, 0xfffff7f4
push 0x5d4c7c
push 0x80000002
call fcn.00407308
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
mov dword [esp], eax
je 0x45f8a0
mov dword [esp + 4], 0x400
mov dword [esp + 8], 1
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x414]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.0040739c
add esp, 0x18
test eax, eax
je 0x45f8a0
lea eax, [esp + 0x40c]
push eax
lea edx, [esp + 0x10]
push edx
call fcn.0045f7dc
add esp, 8
test al, al
jne 0x45f838
push 0x10
push 0
lea ecx, [esp + 0x414]
push ecx
call fcn.0045f794
add esp, 0xc
jmp 0x45f838
push 0x5d4caa
push 0x80000001
call fcn.00407308
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
mov dword [esp], eax
je 0x45f925
mov dword [esp + 4], 0x400
mov dword [esp + 8], 1
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x414]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.0040739c
add esp, 0x18
test eax, eax
je 0x45f925
lea eax, [esp + 0x40c]
push eax
lea edx, [esp + 0x10]
push edx
call fcn.0045f7dc
add esp, 8
test al, al
jne 0x45f8bd
push 0x10
push 0
lea ecx, [esp + 0x414]
push ecx
call fcn.0045f794
add esp, 0xc
jmp 0x45f8bd
mov eax, 1
add esp, 0x80c
pop ebx
ret
Function at 0x461740
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x46175c
mov ebx, dword [ebp + 8]
push 0
push 0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x461797
test byte [ebp + 0x21], 1
je 0x461790
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.0046147c
add esp, 0x10
xor eax, eax
jmp 0x4618cb
test esi, esi
jne 0x4617af
push edi
lea edi, [ebp - 0x110]
mov eax, edi
mov esi, 0x5d4e3e
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
jmp 0x4617c4
push esi
push 0x5d4e41
lea edx, [ebp - 0x110]
push edx
call fcn.004d1ac0
add esp, 0xc
test edi, edi
je 0x4617e0
lea esi, [ebp - 0x110]
push edi
lea eax, [ebp - 0x110]
push eax
call fcn.004cd308
add esp, 8
jmp 0x4617e2
xor esi, esi
mov edi, 0x10
test esi, esi
jne 0x4617f7
test byte [ebp + 0x21], 0x10
jne 0x4617f7
or edi, 0x100
mov eax, dword [ebp + 0x1c]
push eax
push esi
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 1
push 2
push edi
push 0xf01ff
push ebx
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CreateServiceA
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
jne 0x461858
test byte [ebp + 0x21], 1
je 0x461844
push 0
mov ecx, dword [ebp + 8]
push ecx
push 2
call sub.KERNEL32.dll_GetLastError
push eax
call fcn.0046147c
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
call fcn.0046170c
add esp, 8
xor eax, eax
jmp 0x4618cb
test ebx, ebx
je 0x4618b9
push 0x5d4e45
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x4618b9
push 0x5d4e52
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x4618b9
xor eax, eax
push esi
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x110]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0xc], eax
push edx
push 1
mov ecx, dword [ebp - 4]
push ecx
call esi
test eax, eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
call fcn.0046170c
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46191c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x10000
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x461943
xor eax, eax
jmp 0x461976
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_DeleteService
test eax, eax
jne 0x461964
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 8]
push eax
call fcn.0046170c
add esp, 8
xor eax, eax
jmp 0x461976
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.0046170c
add esp, 8
mov al, 1
pop ecx
pop ecx
pop ebp
ret
Function at 0x46197c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 0x20
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x4619a0
xor eax, eax
jmp 0x4619e3
lea edx, [ebp - 0x24]
push edx
push 1
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_ControlService
test eax, eax
jne 0x4619c7
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
call fcn.0046170c
add esp, 8
xor eax, eax
jmp 0x4619e3
mov edx, dword [ebp + 0xc]
push edx
call fcn.004d934c
pop ecx
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 8]
push eax
call fcn.0046170c
add esp, 8
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4619e8
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x10
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x461a0c
xor eax, eax
jmp 0x461a43
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_StartServiceA
test eax, eax
jne 0x461a31
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 8]
push eax
call fcn.0046170c
add esp, 8
xor eax, eax
jmp 0x461a43
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.0046170c
add esp, 8
mov al, 1
pop ecx
pop ecx
pop ebp
ret

Function at 0x461a48
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 4
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x461a6c
xor eax, eax
jmp 0x461aab
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_QueryServiceStatus
test eax, eax
je 0x461a99
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x461a99
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.0046170c
add esp, 8
mov al, 1
jmp 0x461aab
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.0046170c
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x461bbc
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 4
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.00461690
add esp, 0x10
test al, al
jne 0x461be0
xor eax, eax
jmp 0x461c17
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_QueryServiceStatus
test eax, eax
je 0x461c05
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
push edx
call fcn.0046170c
add esp, 8
mov al, 1
jmp 0x461c17
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
push ecx
call fcn.0046170c
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret