joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e23a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x41e3c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41e36f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41e2cf
mov byte [ebp - 1], 0
push 0
push 0x44d3
lea eax, [ebp - 1]
push eax
push 1
push 0x70ef
call fcn.004207af
add esp, 0x14
jmp 0x41e36d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x41e315
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x41e36d
mov dword [ebp - 0x48], 1
push 0x620f
push 0x317c
push 0x613d
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
push dword [ebp - 8]
push dword [ebp - 0x54]
push 1
call fcn.0040ab5f
add esp, 0x2c
push 0
push 0x1584
push 0
push 0
push 0x509
push 1
call fcn.00428b08
add esp, 0x18
jmp 0x41e30a
jmp 0x41e3be
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x41e39e
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x41e39c
push 0x1053
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x41e3be
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x41e3be
push 0
push 0x22a2
push 0xcf2
call fcn.0042691e
add esp, 0xc
jmp 0x41e3f7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
push 0x4e91
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push 1
call fcn.00411c31
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x42154c
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x4215d1
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4215c4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4215b3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4215b1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xbb6
push 0x2432
push 0x16dc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4215c2
push 0
push 0x1f90
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x4215cc
push 0
call fcn.00429d0e
pop ecx
jmp 0x421671
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x421629
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00418885
add esp, 0xc
jmp 0x421671
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0x4ec2
push 0
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
push 0x5003
push 0x29db
push dword [ebp - 0x4c]
call fcn.00409af6
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x421b41
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x421c9f
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x421c6d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x421c0c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x421c0a
push 1
push 0x3673
push 0x41ec
push 0x70fd
push 0x15b9
push 0x324a
push 0x7a1b
push 0x12af
push 1
push 1
push 1
push 0x2694
push 0x3d0
push 0x2a69
push 0x2a5c
call fcn.004209d0
add esp, 0x3c
jmp 0x421c6b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x1b
jmp 0x421c3a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 8
jne 0x421c6b
push 0
push 0x7af8
push dword [ebp - 0x3c]
push 1
push 0x4461
push 0xc40
push 1
push 0xa4d
push 1
call fcn.0041d8c5
add esp, 0x24
jmp 0x421c2f
jmp 0x421c9d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x421c97
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
and dword [eax], 0
jmp 0x421c9d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x421cc6
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x58], eax
push 0
push 1
push 0x677c
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x5c]
call fcn.00421f09
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x42241e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42245b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x55bd
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 0x58f5
push 1
call fcn.00422512
add esp, 0x14
jmp 0x42250e
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4224c7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4224bb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4224b9
push 0x195d
push 1
push 0x6c3
push 0x6f0
push 0
push 0x616b
call fcn.00416471
add esp, 0x18
jmp 0x4224c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x42250e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x422503
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 2
mov ecx, dword [ebp - 0x34]
call fcn.0042f416
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x42250e
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x422ef0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x42300c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x422fc0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x422f69
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x422fbe
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffe4
jmp 0x422f8b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xf
je 0x422fbe
push 0x5b10
push 0
push 1
push 0x2321
push 0x5bbd
push 0x219a
push 0x49b1
push 1
push 1
call fcn.004167c8
add esp, 0x24
jmp 0x422f80
jmp 0x423007
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x422fed
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [eax], 0xac39b398
jmp 0x423007
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x423007
push 0x6f
push 1
push 0
call fcn.0041d533
add esp, 0xc
jmp 0x42309a
lea eax, [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x6c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x423074
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x42306a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x423068
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x423072
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x42309a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
push 0
push 0x2314
push dword [ebp - 0x70]
push 0x55cb
push dword [ebp - 0x74]
call fcn.00409c6f
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4353aa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4354ff
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4354bc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43546f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x435450
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x43546d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.0042f416
mov dword [eax], 6
jmp 0x435445
jmp 0x4354ba
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x43549d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x4354ba
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.0042f416
mov dword [eax], 0x12a2ef7e
jmp 0x435492
jmp 0x4354fd
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x4354dc
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4354fd
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x4354fd
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x43550d
push 0x307b
push 0
call fcn.00453604
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437b17
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x437b78
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x437b5b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x55a0
push 0
call fcn.00454b1c
add esp, 0xc
jmp 0x437b73
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push 0x5cdb
call fcn.0043f644
add esp, 0xc
jmp 0x437c20
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437bd6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x437bc5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437bc3
push 0x8ff
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x437bd4
push 0
push 0x1f90
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x437c20
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x683e
push dword [ebp - 0x30]
push 0
push 0
push 0x4ab7
push 0x70f
push 0xa0c
push 1
push 0x4af3
push dword [ebp - 0x34]
push 0x764e
push 0x6e50
push 0x62ca
push 1
call fcn.00452a17
add esp, 0x38
mov esp, ebp
pop ebp
ret
Function at 0x4388d3
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x438988
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43896a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0042f416
mov dword [eax], 0xfffffffa
jmp 0x438937
push 0
mov ecx, dword [ebp - 4]
call fcn.0042f416
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0042f416
cmp dword [eax], 0xa
jge 0x438968
mov dword [ebp - 0x18], 0x2edc7555
push 3
mov ecx, dword [ebp - 4]
call fcn.0042f416
cmp dword [eax], 0
je 0x43895e
jmp 0x438968
cmp dword [ebp - 0x18], 0
je 0x438966
jmp 0x43891f
jmp 0x43891f
jmp 0x438986
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x438986
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x4389bd
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push 0x7132
push 0x3642
push 0x18aa
push 0x75aa
push dword [ebp - 0x2c]
push 0
push 0x1fbf
call fcn.0044a832
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x43ac03
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43acdb
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43acaf
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43ac8c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43ac8a
push 0
push 0x3bc7
push 0
push 0x7683
push 1
push 0x2f5c
push 0x7cee
push 1
push 1
push 0x57ea
push 0x7296
push 0x6eb1
push 1
call fcn.004371d6
add esp, 0x34
jmp 0x43acad
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43acad
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x43acd6
push 0x4261
push 1
push 0x45e4
push 0x2639
push 0
push 0
push 0x2b79
push 0x21ba
call fcn.00451a14
add esp, 0x20
jmp 0x43ad83
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43ad56
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43ad3f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43ad54
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0x2ccd2044
jmp 0x43ad83
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
push 1
push dword [ebp - 0x58]
push 0
push dword [ebp - 0x5c]
push 0x264d
push 0x2421
push 0x40c6
call fcn.00442975
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x43eb62
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43ecca
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43ec69
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43ec05
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x43ec03
push 0x7233
push 0x5e83
push 0x6487
push 0
call fcn.00441276
add esp, 0x10
jmp 0x43ec67
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x43ec3e
mov dword [ebp - 0xc], 1
jmp 0x43ec42
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx]
jle 0x43ec5b
mov dword [ebp - 0x14], 1
jmp 0x43ec5f
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x43ecc8
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x43ec8a
push 0
push 0x484
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x43ecc8
mov byte [ebp - 1], 0
push 0x2e20
push 0
push 0x5b42
push 0
push 0x36a1
push 0x7cea
lea eax, [ebp - 1]
push eax
push 0x2c6d
push 0x64e
push 0x57a3
push 0x6d85
push 0
call fcn.00440894
add esp, 0x30
jmp 0x43ecdb
push 0
push 1
push 0x49bd
call fcn.0043d319
add esp, 0xc
mov esp, ebp
pop ebp
ret