joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419e80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
call fcn.0041ab20
test eax, eax
jne 0x419e9f
mov edx, esi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [0x4460b8]
test edi, edi
je 0x419ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x419ed8
mov esi, dword [edi + 0xc]
mov eax, esi
mov ebx, dword [edi + 0x10]
mov edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
call fcn.0041a970
mov esi, eax
mov ebx, edx
test esi, esi
je 0x419fa0
or dword [esi + 0x94], 1
mov dword [esi + 0x84], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 2
push edi
mov dword [esi + 0x98], eax
lea eax, [esi + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x419fce
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov ecx, dword [esi + 8]
test eax, eax
je 0x419fb2
push dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [ebp - 8], eax
test eax, eax
je 0x419f79
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
test eax, eax
je 0x419f79
mov eax, dword [ebp - 8]
mov dword [esi + 0x9c], eax
jmp 0x419f7e
mov edi, 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x88], eax
push esi
push dword [0x4460b8]
call fcn.00419ff0
add esp, 8
test edi, edi
jne 0x419fce
pop edi
mov dword [esi + 0x18], 2
mov eax, esi
pop esi
mov edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x88], eax
push esi
push dword [0x4460b8]
call fcn.00419ff0
add esp, 8
push ebx
push esi
mov dword [esi + 8], 0
call fcn.0041aee0
add esp, 8
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419ff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [0x4460b8]
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x41a0a7
call fcn.00419e80
mov esi, eax
mov dword [ebp - 4], edx
test esi, esi
je 0x41a0dd
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
test edi, edi
je 0x41a14d
test esi, esi
je 0x41a138
cmp dword [edi + 4], ebx
je 0x41a138
test ecx, ecx
je 0x41a138
lea eax, [ebp - 0x20]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041a740
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.0041a740
mov eax, dword [esi + 0x30]
add esp, 0x10
test eax, eax
je 0x41a076
cmp dword [eax + 4], edi
je 0x41a123
mov eax, dword [eax + 8]
test eax, eax
jne 0x41a066
push 0x18
push 1
call fcn.0042409b
add esp, 8
test eax, eax
jne 0x41a0f6
lea ebx, [eax + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0041a7d0
lea eax, [ebp - 0x20]
push eax
call fcn.0041a7d0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x41a0d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebx]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x41a0d6
mov eax, dword [ebx + 0x10]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], eax
jmp 0x41a01c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x41a0e9
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 4], eax
jmp 0x41a01f
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov ecx, dword [edi + 0xc]
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x41a10b
mov dword [ecx + 0x14], eax
mov dword [edi + 0xc], eax
mov dword [eax + 0x10], ebx
mov ecx, dword [esi + 0x30]
mov dword [eax + 8], ecx
test ecx, ecx
je 0x41a11e
mov dword [ecx + 0x10], eax
mov dword [esi + 0x30], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0041a7d0
lea eax, [ebp - 0x20]
push eax
call fcn.0041a7d0
add esp, 8
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
mov ecx, 0xb
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4460b4], 0
je 0x41a262
push edi
mov edi, dword [0x4460b8]
test edi, edi
je 0x41a258
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x41a24d
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.0041a2d0
lea eax, [ebp - 0x10]
push eax
lea eax, [edi + 0x20]
push eax
call fcn.0041a740
lea eax, [ebp - 0x10]
mov dword [edi + 0x18], 7
push eax
call fcn.0041a7d0
mov eax, dword [edi + 0x7c]
add esp, 0x14
test eax, eax
je 0x41a223
push ebx
mov ebx, dword [eax]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
mov dword [ebx + 0xc], edi
mov esi, dword [ecx + 0xc]
test esi, esi
je 0x41a1ef
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov esi, dword [ecx + 8]
test esi, esi
je 0x41a1fc
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
cmp dword [edx + 0x7c], ecx
jne 0x41a207
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x7c], eax
mov eax, dword [ebx + 0x18]
or ecx, 0xffffffff
add eax, 4
xchg dword [eax], ecx
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 0x7c]
test eax, eax
jne 0x41a1d7
pop ebx
cmp dword [edi + 0x84], 1
jne 0x41a24d
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.0041aea0
mov eax, dword [0x4460b8]
add esp, 8
test eax, eax
je 0x41a24d
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41aab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
nop dword [eax]
cmp dword [0x4460b4], 0
jne 0x41aace
call fcn.0041ab20
mov esi, dword [0x4460bc]
test esi, esi
je 0x41ab1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x41ab1a
test ebx, ebx
je 0x41ab07
mov eax, dword [esi]
test eax, eax
je 0x41ab07
push dword [esi + 4]
call eax
add esp, 4
push dword [esi + 8]
push dword [0x4460bc]
call fcn.00419ff0
add esp, 8
jmp 0x41aac0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41ab20
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x4460b4], 0
jne 0x41acae
push esi
xorps xmm0, xmm0
mov dword [0x44541c], 1
push 0x10
push 1
mov dword [0x445420], 1
mov dword [0x4460b8], 0
mov dword [0x4460bc], 0
mov dword [0x4460c0], 0
mov dword [0x4460c4], 0
mov dword [0x4460d0], 0
mov dword [0x4460d4], 0
movlpd qword [0x4460c8], xmm0
mov dword [0x4460b0], 0
mov dword [0x4460d8], 0
mov dword [0x4460dc], 0
mov dword [0x4460e4], 0
mov dword [0x4460e8], 0
mov dword [0x4460ec], 0
mov dword [0x4460e0], 0
call fcn.0042409b
mov esi, eax
add esp, 8
test esi, esi
jne 0x41abfd
mov dword [0x4460b8], esi
call fcn.0041acc0
mov dword [0x4460b4], 1
mov eax, 1
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41ac33
push esi
call fcn.004211d6
add esp, 4
mov dword [0x4460b8], 0
call fcn.0041acc0
mov dword [0x4460b4], 1
mov eax, 1
pop esi
ret
push 0x10
push 1
mov dword [0x4460b8], esi
call fcn.0042409b
mov esi, eax
add esp, 8
test esi, esi
jne 0x41ac67
mov dword [0x4460bc], esi
call fcn.0041acc0
mov dword [0x4460b4], 1
mov eax, 1
pop esi
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41ac9d
push esi
call fcn.004211d6
add esp, 4
mov dword [0x4460bc], 0
call fcn.0041acc0
mov dword [0x4460b4], 1
mov eax, 1
pop esi
ret
mov dword [0x4460bc], esi
mov dword [0x4460b4], 1
pop esi
mov eax, 1
ret

Function at 0x41af60
Capabilities:
Get thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [0x4460b8]
test edi, edi
je 0x41af94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x41af94
mov dword [edi + 0x18], 6
mov esi, dword [ebp + 8]
cmp esi, 2
je 0x41afa8
cmp esi, 1
je 0x41afa8
push 1
call fcn.004209fb
test edi, edi
je 0x41afb5
test byte [edi + 0x94], 1
je 0x41afdd
mov eax, esi
xor ebx, ebx
sub eax, 1
je 0x41afc8
sub eax, 1
jne 0x41afcf
or ebx, 0xffffffff
jmp 0x41afcf
test edi, edi
je 0x41afcf
mov ebx, dword [edi + 0x28]
call fcn.0041a160
push ebx
call fcn.00424366
add esp, 4
push 1
call fcn.0041aab0
add esp, 4
lea eax, [edi + 0x38]
push esi
push eax
call fcn.0041d54b
int3
Function at 0x429ca0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429b16
Function at 0x1002c29e
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c337
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002c2ea
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1002c335
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002c318
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002c335
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010174
mov dword [eax], 0x44ad3740
jmp 0x1002c30d
jmp 0x1002c34f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x38d9
push 0
call fcn.100366b2
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10037ec7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070bc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10037f0b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.1003800e
add esp, 0xc
jmp 0x10038000
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10037f2a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10038000
push 1
lea ecx, [ebp - 0x40]
call fcn.100100d6
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x6de713a
mov dword [ebp - 0x20], 0x6dbc1c23
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x34], 5
push 4
lea ecx, [ebp - 0x4c]
call fcn.100100d6
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 0xf8f6a1c3
mov dword [ebp - 0x10], 0
jmp 0x10037f80
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10037f99
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.10010174
mov dword [eax], 0x55683450
jmp 0x10037f79
push 0x4a1b
lea eax, [ebp - 0x4c]
push eax
push 0x4062
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100407e0
add esp, 0x14
push 0x338d
push 0
lea eax, [ebp - 0x40]
push eax
push 0x54e8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10036b0c
add esp, 0x18
push 0x3d6
lea eax, [ebp - 0x28]
push eax
push 0
call fcn.10036180
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.10010158
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10010158
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003dd84
Capabilities:
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003ddf3
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003ddd3
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003ddd1
push 0xb45
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1003ddf1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003ddf1
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1003de30
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
push 0xc19
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x2f79
push dword [ebp - 0x28]
push 0x100f
push dword [ebp - 0x2c]
push 0
call fcn.1003c96f
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1004092a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100409e6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10040996
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10040994
push 1
push 0xbbc
push 1
push 0x3752
push 0x54af
push 0x38e4
call fcn.1003d414
add esp, 0x18
jmp 0x100409e1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100409c4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100409e1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10010174
mov dword [eax], 0xedade098
jmp 0x100409b9
jmp 0x10040a71
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10040a55
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10040a36
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10040a53
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10010174
mov dword [eax], 0x3638ecf5
jmp 0x10040a2b
jmp 0x10040a71
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10040a71
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x10047805
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10047860
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10047841
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1004785e
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10010174
mov dword [eax], 0xedade098
jmp 0x10047836
jmp 0x1004789b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10047878
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1004789b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004789b
push 0
push 0x8d6
push 0x3ba
push 0x4e1
call dword [sym.imp.GDI32.dll_MoveToEx]
mov esp, ebp
pop ebp
ret

Function at 0x10048e52
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10048ed1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10048e84
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10048ecf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10048eb2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10048ecf
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010174
mov dword [eax], 0xfff8
jmp 0x10048ea7
jmp 0x10048eed
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.10045d8b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1004b958
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004b9ce
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004b9a1
mov byte [ebp - 1], 0
push 0x653e
push 0x1c88
lea eax, [ebp - 1]
push eax
push 0x64be
push 0
push 1
call fcn.1004f178
add esp, 0x18
jmp 0x1004b9c9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1004b9c9
push 0x7f4
push 0xc9
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x1004ba76
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1004ba14
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1004ba76
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x44]
call fcn.10010174
mov dword [ebp - 8], eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.10010174
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004e795
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004e83a
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1004e7ed
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004e7eb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1004e838
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004e81b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1004e838
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10010174
mov dword [eax], 0x59008cf5
jmp 0x1004e810
jmp 0x1004e84e
push 0x1e6a
push 0x5e76
push 0
call fcn.1004560e
add esp, 0xc
mov esp, ebp
pop ebp
ret