joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468a68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x38]
sub edi, dword [ebx + 0x70]
sub edi, dword [ebx + 0x68]
jmp 0x468a97
mov eax, dword [ebx + 0x28]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x68]
ja 0x468b16
push esi
mov eax, dword [ebx + 0x34]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004676d8
add esp, 0xc
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x58], ebp
mov eax, dword [ebx + 0x48]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x468ae4
mov cx, word [esp]
sub cx, si
jmp 0x468ae6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x468acd
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x468b0c
mov cx, word [esp]
sub cx, si
jmp 0x468b0e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x468af5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x468b73
mov edx, dword [ebx + 0x34]
mov ecx, edi
add edx, dword [ebx + 0x68]
mov eax, ebp
add edx, dword [ebx + 0x70]
call fcn.00468758
add dword [ebx + 0x70], eax
cmp dword [ebx + 0x70], 3
jb 0x468b5e
mov eax, dword [ebx + 0x34]
mov edx, dword [ebx + 0x68]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x44], eax
mov ecx, dword [ebx + 0x54]
shl eax, cl
mov edx, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x68]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x44], eax
cmp dword [ebx + 0x70], 0x106
jae 0x468b73
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x468a72
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46d140
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff68
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x94
call fcn.00403af4
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46d1b0
cmp dword [esp + 0x14], 2
jne 0x46d1b0
cmp dword [esp + 8], 6
jb 0x46d1b0
push 0x46d1c0
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x46d1aa
push 0x46d1cc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov ebp, eax
mov edi, ebp
test ebp, ebp
je 0x46d1aa
push esp
call edi
movzx ebx, byte [esp]
push esi
call sub.kernel32.dll_FreeLibrary_1
mov eax, ebx
add esp, 0x98
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46d1e4
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff68
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x94
call fcn.00403af4
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x46d260
cmp dword [esp + 0x14], 2
jne 0x46d260
cmp dword [esp + 8], 6
jb 0x46d260
push 0x46d270
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x46d25a
push 0x46d27c
push esi
call sub.kernel32.dll_GetProcAddress_1
mov ebp, eax
mov edi, ebp
test ebp, ebp
je 0x46d25a
cmp byte [esp], 0
je 0x46d256
push 1
call edi
jmp 0x46d25a
push 0
call edi
push esi
call sub.kernel32.dll_FreeLibrary_1
mov eax, ebx
add esp, 0x98
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46d4c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46d535
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x46d548
call fcn.00405864
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x46d54c
push 0x46d554
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d53c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x46d9b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x46d9b8
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x46daf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x41
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405718
lea eax, [ebp - 0xc]
mov edx, 0x46db08
call fcn.00405818
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
cmp esi, 1
jle 0x46daba
lea eax, [ebp - 0x18]
call fcn.0048acec
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a5dc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409b84
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
call fcn.004039a0
mov edx, 0x46db0c
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.00403970
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00405794
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409b84
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00405974
jne 0x46da7c
lea eax, [ebp - 8]
mov edx, 0x46db18
call fcn.004055c8
jmp 0x46da8b
lea eax, [ebp - 8]
mov edx, dword [esi*4 + 0x4951f8]
call fcn.004055c8
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00405718
push dword [ebp - 0x2c]
push 0x46db08
push 0x46db2c
push dword [ebp - 8]
push 0x46db38
lea eax, [ebp - 4]
mov edx, 6
call fcn.004058e0
inc ebx
cmp bl, 0x5b
jne 0x46d9d5
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46daf8
lea eax, [ebp - 0x2c]
call fcn.00405530
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405554
ret

Function at 0x46db3c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.004057a0
add esp, 0x18
pop ebx
ret

Function at 0x46dbac
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dbe0
call sub.user32.dll_FindWindowA
push 0
push 0x46dbf0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x46dc00
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dc10
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dc44
call sub.user32.dll_FindWindowA
push 0
push 0x46dc54
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x46dc64
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dc74
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dc98
call sub.user32.dll_FindWindowA
push 0
push 0x46dca8
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dcb8
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dcdc
call sub.user32.dll_FindWindowA
push 0
push 0x46dcec
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x46dcfc
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dd20
call sub.user32.dll_FindWindowA
push 0
push 0x46dd30
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd40
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dd64
call sub.user32.dll_FindWindowA
push 0
push 0x46dd74
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dd84
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46dda0
push 0
push 0
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46dda8
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x46ddc4
push 0
push 0
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x46ddcc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46de87
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46de6c
xor eax, eax
push ebp
push 0x46de65
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46de6c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46de8e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x46de94
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46df54
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46df39
xor eax, eax
push ebp
push 0x46df32
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46df39
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46df5b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret

Function at 0x46e238
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e394
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ee4
cmp eax, 5
ja case.default.0x46e27e
jmp dword [eax*4 + 0x46e285]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e27e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e27e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e27e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e27e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e27e
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e39b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405554
ret
Function at 0x46e3a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e4ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409ee4
cmp eax, 5
ja case.default.0x46e3db
jmp dword [eax*4 + 0x46e3e2]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e3db
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e3db
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e3db
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e3db
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x46e3db
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
push 0x46e4f8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e4f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x46e54c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
xor eax, eax
push ebp
push 0x46e6ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x46e676
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x124]
mov eax, dword [0x495a3c]
call fcn.0042be60
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x14]
mov ecx, 0x46e6c8
call fcn.00407050
mov eax, dword [ebp - 0xc]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 5
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.004057a0
push dword [ebp - 0x128]
push 0x46e6e0
push dword [ebp - 8]
push 0x46e6ec
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004058e0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
call fcn.0040646c
push eax
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 0x14]
mov ecx, 0x46e6f4
call fcn.00407050
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e6c1
lea eax, [ebp - 0x12c]
call fcn.0040700c
lea eax, [ebp - 0x128]
call fcn.00405530
lea eax, [ebp - 0x124]
call fcn.0040700c
lea eax, [ebp - 0x14]
call fcn.0040700c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
ret
Function at 0x46e70c
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffe68
xor ebx, ebx
push 0
push 0x2c
lea eax, [esp + 0x160]
push eax
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46e853
push 0
push 0x20
lea eax, [esp + 0x140]
push eax
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46e853
push 0
push 0x138
lea eax, [esp + 8]
push eax
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46e853
cmp dword [0x495218], 0
jne 0x46e776
cmp dword [0x495214], 0
je 0x46e826
mov eax, dword [esp]
mov edx, dword [esp + 4]
sub eax, dword [0x495214]
sbb edx, dword [0x495218]
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], edx
fild qword [esp + 0x184]
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
sub eax, dword [0x49521c]
sbb edx, dword [0x495220]
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], edx
fild qword [esp + 0x18c]
fdivp st(1)
fmul dword [0x46e860]
movzx eax, byte [esp + 0x180]
mov dword [esp + 0x194], eax
fild dword [esp + 0x194]
fdivp st(1)
fsubr dword [0x46e860]
fadd dword [0x46e864]
call fcn.0040345c
mov dword [0x495224], eax
mov eax, dword [0x495224]
xor edx, edx
cmp edx, dword [0x495218]
jne 0x46e81e
cmp eax, dword [0x495214]
je 0x46e826
mov ebx, dword [0x495224]
mov eax, dword [esp]
mov dword [0x495214], eax
mov eax, dword [esp + 4]
mov dword [0x495218], eax
mov eax, dword [esp + 0x140]
mov dword [0x49521c], eax
mov eax, dword [esp + 0x144]
mov dword [0x495220], eax
mov eax, ebx
add esp, 0x198
pop ebx
ret
Function at 0x47116c
Capabilities:
Find taskbar

Disassembly:
cmp al, 1
jne 0x471194
push 0xffffffffffffffff
push 0
push 0x4711bc
push 0
push 0
push 0x4711c4
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
ret
test al, al
jne 0x4711bb
push 0
push 0
push 0x4711bc
push 0
push 0
push 0x4711c4
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
push eax
call sub.user32.dll_EnableWindow
ret

Function at 0x4711d4
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push 5
push 0
push 0x4711ec
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4711fc
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push 0
push 0
push 0x471214
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x47124c
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471316
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x471324
call sub.user32.dll_FindWindowA
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x4712f5
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4712e7
lea edx, [ebp - 4]
lea eax, [ebp - 0x84]
call fcn.0040aab0
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.004097e4
mov eax, dword [ebp - 0x88]
mov edx, 0x47133c
call fcn.00405974
jne 0x4712e7
cmp bl, 1
jne 0x4712df
push 1
push esi
call sub.user32.dll_ShowWindow
jmp 0x4712e7
push 0
push esi
call sub.user32.dll_ShowWindow
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x47128c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47131d
lea eax, [ebp - 0x88]
call fcn.00405530
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x471344
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x4713ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov esi, dword [ebp + 8]
test esi, esi
je 0x47139b
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp + 8]
call fcn.004059dc
push eax
push 2
push 0
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x4713c1
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4713f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret
Function at 0x471614
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004059cc
xor eax, eax
push ebp
push 0x4716fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405530
xor eax, eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4716da
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x471676
mov edi, 0x10
jmp 0x47167b
mov edi, 0x20
or edi, 4
push edi
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x4716d4
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4716c4
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4716b8
lea eax, [ebp - 0x10]
push eax
push 0
push edi
call sub.advapi32.dll_StartServiceA
jmp 0x4716c4
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x2c]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, esi
mov eax, dword [ebp - 0x28]
call fcn.004714dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471701
lea eax, [ebp - 4]
call fcn.00405530
ret