joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444bb9
Capabilities:
Log keystrokes via polling
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x444bfa
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
push 1
push 0x34f
push dword [ebp - 8]
push 0x5268
push 0x282f
push dword [ebp - 0xc]
call fcn.00444d79
add esp, 0x18
jmp 0x444d75
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x444d23
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x444d19
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0x4aa1
push 0x5655
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0x4e76
push 0
mov eax, dword [ebp - 0x60]
push dword [eax]
push 0x2fdf
push 0x186
push 0x33df
mov eax, dword [ebp - 0x64]
push dword [eax]
push 0x6cca
push 1
push 1
push 0x10a
push 0x839
push 0x593
push 1
push 0x648b
push 0x76ca
push 0x745c
push 0x19f0
push 1
push dword [ebp - 0x68]
call fcn.00451db1
add esp, 0x60
jmp 0x444d21
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x444d75
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
movzx eax, byte [eax]
test eax, eax
je 0x444d4f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x444d4d
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x444d75
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
movzx eax, byte [eax]
test eax, eax
je 0x444d75
push 0x622
push 0x234c
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov esp, ebp
pop ebp
ret
Function at 0x44a533
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44a5cc
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44a5b0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44a584
push 0
push 0x454
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x44a5ae
mov byte [ebp - 1], 0
push 0
push 0x23a9
push 0x753a
push 0
push 1
push 0x40d4
push 0x5909
lea eax, [ebp - 1]
push eax
call fcn.00450fd2
add esp, 0x20
jmp 0x44a5ca
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x7837
push 1
call fcn.004146b5
add esp, 0x10
jmp 0x44a63f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44a612
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 1
call fcn.0040da7d
add esp, 0xc
jmp 0x44a63f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0
push 0x2967
push dword [ebp - 0x38]
push 0
push 0x5ff6
push 0x17f7
push dword [ebp - 0x3c]
call fcn.0041571a
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x44a643
Capabilities:
Get disk information
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc7cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x44a698
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push 0xe77
push 1
push dword [ebp - 0x2c]
push 0x2561
call fcn.0044a7fb
add esp, 0x14
jmp 0x44a7ea
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x44a7c9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x44a6db
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x44a7c7
mov dword [ebp - 0x24], 0x3a6f
mov dword [ebp - 0x3c], str.sdbauxhnj_jnkxnltr_bnsdbvmqi
cmp dword [ebp - 0x24], 0x3b11
jle 0x44a781
and dword [ebp - 0x14], 0
jmp 0x44a703
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3b70
jge 0x44a781
and dword [ebp - 0x18], 0
jmp 0x44a719
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1710
jge 0x44a77c
and dword [ebp - 0x1c], 0
jmp 0x44a72f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6d5a
jge 0x44a77a
and dword [ebp - 0x20], 0
jmp 0x44a745
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x73ad
jge 0x44a778
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xace058
call fcn.004063d1
jmp 0x44a73e
jmp 0x44a728
jmp 0x44a712
jmp 0x44a6fc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x382b
jge 0x44a7a1
mov edx, dword [ebp - 0x3c]
mov ecx, 0xace058
call fcn.00409042
jmp 0x44a7bd
or dword [ebp - 4], 0xffffffff
jmp 0x44a7c7
jmp 0x44a7ea
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
push 0x3d84
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.00426967
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44adf8
Capabilities:
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44af05
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44ae98
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44ae6a
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x44ae96
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x44af03
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x44aef2
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
jmp 0x44af03
push 0
push 0x454
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x44af2f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x6c], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x68], eax
push 1
push 0x269
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
push eax
push 0x5be6
push dword [ebp - 0x6c]
call fcn.004230d8
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x45c62d
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc9f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x45c78c
lea eax, [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x7eab
mov dword [ebp - 0x30], str.zprk_esdl_gvns_lfrz_tojkuxdbn
cmp dword [ebp - 0x2c], 0x81c4
jle 0x45c70b
and dword [ebp - 0x18], 0
jmp 0x45c68f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x76ec
jge 0x45c6ec
and dword [ebp - 0x1c], 0
jmp 0x45c6a5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x435e
jge 0x45c6ea
and dword [ebp - 0x20], 0
jmp 0x45c6bb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x8b
jge 0x45c6e8
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0xace058
call fcn.004063d1
jmp 0x45c6b4
jmp 0x45c69e
jmp 0x45c688
push 0
push 0
push 0x733
push 0
push 0x302
push 0
push 0
push 0x1933
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x7b3f
jge 0x45c72b
mov edx, dword [ebp - 0x30]
mov ecx, 0xace058
call fcn.00409042
jmp 0x45c747
or dword [ebp - 4], 0xffffffff
jmp 0x45c751
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x34]
push 1
push dword [ebp - 0x38]
push 0x6731
push 0x5d47
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 1
push 0x527f
push dword [ebp - 0x40]
push 0x7efe
call fcn.0045c852
add esp, 0x28
jmp 0x45c841
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
push 1
lea ecx, [ebp - 0x58]
call fcn.00406726
mov dword [ebp - 0x28], 0x4a12b57e
mov dword [ebp - 0x24], 0
jmp 0x45c7b3
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x45c7cc
push dword [ebp - 0x24]
lea ecx, [ebp - 0x58]
call fcn.00406814
mov dword [eax], 0x99ac7894
jmp 0x45c7ac
mov dword [ebp - 0x28], 0
jmp 0x45c7dc
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x45c7f8
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x45c7f6
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
jmp 0x45c7d5
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x45c820
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0x58]
call fcn.004067f8
push 0x2965
push 0
push 1
push 0x21ba
push dword [ebp - 0x44]
call fcn.0046af6f
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4669f4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x466aaa
lea eax, [ebp + 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x466a86
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x466a7c
mov byte [ebp - 1], 0
push 0x4726
push 0x3f33
push 0x40be
push 0x749e
push 0x3d10
push 1
push 0x38fc
push 0
push 0
push 0x4392
lea eax, [ebp - 1]
push eax
push 0x92c
push 0x2625
push 0x67f
call fcn.0045a0f2
add esp, 0x38
jmp 0x466a84
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x466aa8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x1c2f
push 0x34b5
push 0x3ac5
push 0
push dword [ebp - 0x18]
call fcn.00477950
add esp, 0x14
jmp 0x466b01
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push 0x300e
push dword [ebp - 0x1c]
push 0x1332
push 1
push 0x2fd2
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
push 0x7132
push 0x37a0
push dword [ebp - 0x28]
push 0x1163
push dword [ebp - 0x2c]
call fcn.0047b4d6
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x469694
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4696bd
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
push eax
push 1
call fcn.004697f9
pop ecx
pop ecx
jmp 0x4697f5
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x46976f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x46971f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x46976a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x46974d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x46976a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00406814
mov dword [eax], 0xdae5a60d
jmp 0x469742
jmp 0x4697f5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x4697aa
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4697a8
push 0
push 0x454
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x4697f5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x4697d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jge 0x4697f5
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x5c]
call fcn.00406814
mov dword [eax], 0xfffffff9
jmp 0x4697cd
mov esp, ebp
pop ebp
ret
Function at 0x46a8e1
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcb51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x46a921
push 1
push 0x1665
push 1
call fcn.0046aaa3
add esp, 0xc
jmp 0x46aa92
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x64a7
mov dword [ebp - 0x4c], str.wzabvpcfg_umokuji_nsfrcoew_adznftuto_walkkuye_zjbufze_ukxbou_qajwy_arwrfjhcg_qcshzv_llinpg_pdwt_kvrds_mkw
cmp dword [ebp - 0x24], 0x67e3
jle 0x46a9f6
and dword [ebp - 0x1c], 0
jmp 0x46a961
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6613
jge 0x46a9f6
and dword [ebp - 0x14], 0
jmp 0x46a97b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x60f9
jge 0x46a9f1
and dword [ebp - 0x18], 0
jmp 0x46a991
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7256
jge 0x46a9ef
and dword [ebp - 0x20], 0
jmp 0x46a9a7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3bff
jge 0x46a9ed
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sar eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00401a01
pop ecx
pop ecx
mov ecx, eax
call fcn.004063c6
push eax
call fcn.004a68c7
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004063bc
jmp 0x46a9a0
jmp 0x46a98a
jmp 0x46a974
jmp 0x46a95a
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x46aa14
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0
push dword [ebp - 0x30]
call fcn.0046f45d
pop ecx
pop ecx
jmp 0x46aa56
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x46aa3a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x46aa56
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.00406814
mov dword [eax], 0x4a8c6a53
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6448
jge 0x46aa6c
push dword [ebp - 0x4c]
call fcn.004a68c7
pop ecx
jmp 0x46aa88
or dword [ebp - 4], 0xffffffff
jmp 0x46aa92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bb6e
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcb6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46bd60
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46bd18
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x1b70
mov dword [ebp - 0x38], str.xkusajii_rgfkher_hehm_rsq_zfzcbmeyf_yirz_jeocwtd_utymmo_zxgrp_kbyqiqmo_jcsackrcx_pnm
cmp dword [ebp - 0x28], 0x1f3f
jle 0x46bc8d
and dword [ebp - 0x18], 0
jmp 0x46bbea
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5d31
jge 0x46bc80
and dword [ebp - 0x1c], 0
jmp 0x46bc04
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7539
jge 0x46bc7b
and dword [ebp - 0x20], 0
jmp 0x46bc1a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2b7d
jge 0x46bc79
and dword [ebp - 0x24], 0
jmp 0x46bc30
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x46ca
jge 0x46bc77
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
xor edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00401a01
pop ecx
pop ecx
mov ecx, eax
call fcn.004063c6
push eax
call fcn.004a68c7
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.004063bc
jmp 0x46bc29
jmp 0x46bc13
jmp 0x46bbfd
jmp 0x46bbe3
push 0
push 0xd1d
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x46bcbe
mov byte [ebp - 0x11], 0
push 1
push 0
push 0x1e09
push 1
push 0x6f01
lea eax, [ebp - 0x11]
push eax
push 0x4dbe
call fcn.00476502
add esp, 0x1c
jmp 0x46bcda
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x18f5
jge 0x46bcf0
push dword [ebp - 0x38]
call fcn.004a68c7
pop ecx
jmp 0x46bd0c
or dword [ebp - 4], 0xffffffff
jmp 0x46bd16
jmp 0x46bd5e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push 0
push 0
push 0x6e6b
push dword [ebp - 0x40]
push 0x7802
push 0x5f6d
push 1
push 0x546
push 0x5880
push 0x7175
push 0x73f6
push 0x4024
push 0x2673
push 1
call fcn.00468609
add esp, 0x38
jmp 0x46bd8a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
push 0x792b
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
push dword [ebp - 0x4c]
call fcn.0045dca4
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret