joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a2d
Capabilities:
Get file attributes
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x412abf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x412aac
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x412a8c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x412a8a
push 0
push 0x2175
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x412aaa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x412aaa
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x412abd
push 0x7b0e
push 1
push 1
call fcn.00407ea3
add esp, 0xc
jmp 0x412aca
push 1
push 1
call fcn.00409dbe
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x413f93
Capabilities:
Enumerate gui resources
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x413fbc
push 1
push 1
push 0x3885
push 0x2af6
call fcn.00414093
add esp, 0x10
jmp 0x41408f
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41402c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41401e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41401c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x41402a
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x41408f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x414083
mov byte [ebp - 1], 0
push 0x1439
push 0x63ab
lea eax, [ebp - 1]
push eax
push 1
push 0x6ed6
push 0x304f
push 0x18f2
push 0
push 0x740a
push 0x49e3
push 1
push 0x5f3
push 1
push 0x2951
call fcn.0040b736
add esp, 0x38
jmp 0x41408f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov esp, ebp
pop ebp
ret
Function at 0x415d44
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x415d75
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
push 0
push 0x2cd7
push 1
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call fcn.0041f4d6
add esp, 0x10
jmp 0x415e21
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x415e19
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x415dd7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x415dd5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x415e17
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
push 0x184
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov eax, dword [ebp - 0x40]
push dword [eax]
push dword [ebp - 0x44]
push 0
call fcn.00412b9e
add esp, 0x14
jmp 0x415e21
push 0
call fcn.00411703
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x415e5d
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x415eb0
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x20]
push 1
push 0x282a
call fcn.00415f9a
add esp, 0x1c
jmp 0x415f96
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x415f39
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x415f20
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x415f1e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x415f37
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x415f96
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x415f82
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x415f96
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0
call fcn.0041288a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x416ae5
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x416b72
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x416b58
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x416b4e
mov byte [ebp - 1], 0
push 0x6a42
push 1
push 0x78bb
push 0x610c
push 0xc2f
lea eax, [ebp - 1]
push eax
push 0
push 0xc35
call fcn.0041719f
add esp, 0x20
jmp 0x416b56
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x416b70
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x66f0
push 0
push dword [ebp - 0x18]
call fcn.00421d61
add esp, 0xc
jmp 0x416bb2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.0040ecac
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4176e9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x417805
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x417740
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push dword [ebp - 0x1c]
push 0x4a60
call fcn.0041786c
add esp, 0xc
jmp 0x417803
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x4177c9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x41777e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 5
jg 0x4177c7
mov byte [ebp - 1], 0
push 0
push 0x2c65
push 1
push 0x512d
push 0
push 0x3cb0
push 0x40f9
push 0x7f65
push 1
push 0x2de
push 0
push 1
lea eax, [ebp - 1]
push eax
push 0x394b
call fcn.004179dc
add esp, 0x38
jmp 0x417773
jmp 0x417803
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x4177eb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jl 0x417803
mov dword [ebp - 0x10], 0xfffffff7
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x4177e0
jmp 0x417868
lea eax, [ebp + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x41784e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x417835
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x41784c
mov byte [ebp - 2], 0
push 0x4d79
push 0
lea eax, [ebp - 2]
push eax
call fcn.00421d61
add esp, 0xc
jmp 0x417868
push 0x5057
push 0
push 0
push 1
push 1
push 0x34ce
call fcn.0040dfe9
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x41a878
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41a913
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41a8f6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41a8ec
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41a8ea
push 0
push 0x17cc
push 0
push 0
push 0x9cd
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x41a8f4
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x41a911
push 0x2512
push 0x4242
push 0
push 1
push 0x598c
call fcn.004178f7
add esp, 0x14
jmp 0x41a921
push 0x5f4e
push 0
call fcn.0040b5fb
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41cb17
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41cc7d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41cc61
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41cb9d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41cb98
push 0x54b
push 0
push 0x1601
push 0x268e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x41cc5f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x41cbcb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x41cc5f
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x41cbf6
push 0x895
push 1
push 1
push 1
call fcn.004154f9
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [eax], 1
jmp 0x41cc0c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jl 0x41cc5a
mov byte [ebp - 3], 0
push 0x561c
push 1
push 1
push 0x1e7b
push 0x6fdc
push 0x37c
push 1
lea eax, [ebp - 3]
push eax
push 0x998
push 0x5887
push 1
push 1
push 1
push 0x6252
push 0x39be
call fcn.004156a2
add esp, 0x3c
jmp 0x41cc01
jmp 0x41cbc0
jmp 0x41cc7b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x38]
push 0x1023
push 0
call fcn.00413f0a
add esp, 0x10
jmp 0x41cc99
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 0xfa2
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
push 0
call fcn.00412ace
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41ffb7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41ffef
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x5ce6
push 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
call fcn.00420081
add esp, 0x10
jmp 0x42007d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x420065
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42005b
mov dword [ebp - 0x1c], 0x62d5e48d
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.00412140
pop ecx
pop ecx
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x2056
push 1
push 0x3e1d
push 1
push 0
push 0x1ec1
push 0x19ca
call fcn.00416e65
add esp, 0x20
jmp 0x420063
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42007d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x24]
push 0x39c7
call fcn.0041b57d
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x422b4f
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x422be2
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x422bd2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x422bb0
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0xd4e
push 1
push 1
push 1
call fcn.00421ddf
add esp, 0x14
jmp 0x422bd0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x422bd0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x422bdd
push 1
push 1
call fcn.00416a6d
pop ecx
pop ecx
jmp 0x422d0d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x422c5a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x422c3e
mov byte [ebp - 2], 0
push 1
push 1
push 0x6d3
lea eax, [ebp - 2]
push eax
push 1
push 0xcc9
push 0
call fcn.004174ca
add esp, 0x1c
jmp 0x422c55
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x422d0d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x422c8e
push 0
push 0
push 0x2260
push 0
push 0x237a
push 0
push 0x173c
push 0x13bc
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x422d0d
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x54], 0xef20fe6e
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x4c], 1
mov dword [ebp - 8], 0
jmp 0x422cba
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x422ccd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5c], 0
jmp 0x422cb3
mov dword [ebp - 8], 0
jmp 0x422cdd
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x422cf0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x68], 0x1a4d63a8
jmp 0x422cd6
push 0
push 0x32d3
lea eax, [ebp - 0x4c]
push eax
push 0x2a16
push 0x15fb
call fcn.00415e25
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x42f697
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42f7b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42f79d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42f77d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0
mov eax, dword [ebp - 0x50]
push dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, ecx
push eax
mov ecx, dword [ebp - 0x60]
call fcn.00451067
jmp 0x42f79b
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
test eax, eax
je 0x42f79b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x42f7b6
push 0x3a10
push 0x280c
push 0x44ef
push 0
call fcn.0043389a
add esp, 0x10
jmp 0x42f7e1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x70], eax
push 1
push 0x463e
push 0x5b07
push 0x6a38
push dword [ebp - 0x70]
push 0x5a89
push 1
call fcn.0042d66e
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x42f99c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42fa13
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42f9d6
push 1
push 0x4e5e
call fcn.0042fa41
pop ecx
pop ecx
jmp 0x42fa11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42f9fa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x42fa11
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42fa3d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push 0x55d9
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.0042fccf
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x4300c9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x430167
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x430129
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x430121
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x430127
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x430165
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
push 0x30
push 0
push 0x462a
push 0x3cc0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.00435cb0
add esp, 0x24
jmp 0x43019d
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
push 1
push 0x304d
push 0x24fa
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
push 0x71c1
push 1
push 0xdf4
call fcn.00429f36
add esp, 0x20
mov esp, ebp
pop ebp
ret