joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43a189
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43a19a
cmp eax, 2
je 0x43a210
jmp 0x43a23d
push 0xbbf966b4
push dword [0x44c2a4]
call fcn.0043f9e0
add esp, 8
test eax, eax
je 0x43a1db
mov ecx, dword [esi]
test ecx, ecx
je 0x43a208
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43a1e4
cmp dword [esp + 4], 0
je 0x43a1e4
mov dword [esi + 4], 3
jmp 0x43a208
mov dword [esi + 4], 1
jmp 0x43a23d
lea eax, [esp + 0xc]
push eax
call fcn.004402f0
add esp, 4
test al, al
je 0x43a208
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43a205
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43a23d
mov ebx, dword [ebp + 0x18]
push 0x732f71fd
push dword [0x4542cc]
call fcn.0043f9e0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43a2c4
mov ecx, dword [esi]
mov dword [esp + 4], 0x9c9d9a9b
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x5a
xor dl, byte [esp + eax + 4]
add dl, 0x3e
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 7
jne 0x43a260
mov eax, dword [esp + 4]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x43a2c4
xor esi, esi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0xfd743ac4
je 0x43a2a0
inc esi
cmp edx, esi
jne 0x43a290
jmp 0x43a2c4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43a2c4
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push edx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x43af30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], 0
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x5a
xor dl, byte [esp + eax]
add dl, 0x3e
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43af70
mov eax, dword [esp]
mov edx, dword [0x44c2b0]
test edx, edx
je 0x43afee
mov ebp, ebx
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3e416e49
je 0x43afb6
inc edi
cmp edx, edi
jne 0x43afa0
mov ebx, ebp
mov ebp, dword [esp + 0x30]
jmp 0x43afee
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
mov ebx, ebp
mov ebp, dword [esp + 0x30]
je 0x43afee
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 4
push 0x3000
push eax
push 0
push edi
push 0xffffffffffffffff
push 6
push edx
push dword [0x44c2b8]
mov edi, ecx
call fcn.0043ca30
mov ecx, edi
add esp, 0x24
test eax, eax
js 0x43b044
push 0
push 0
push dword [esi + 8]
push dword [esp + 0x14]
push dword [esi + 4]
push dword [esi]
call fcn.0043a170
test eax, eax
jns 0x43b01c
mov ecx, eax
xor eax, eax
mov edx, 0
cmp ecx, 0x8000000d
jne 0x43b051
mov edi, dword [esp + 8]
push dword [esp + 0x34]
push ebp
push ebx
push dword [esi + 8]
push edi
call fcn.0043a2d0
add esp, 0x14
test eax, eax
je 0x43b04d
sub eax, edi
mov edx, eax
sar edx, 0x1f
add eax, dword [esi]
adc edx, dword [esi + 4]
jmp 0x43b051
xor eax, eax
xor edx, edx
jmp 0x43b0e2
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], 0
mov dword [esp], 0x9c9d9a9b
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
mov ebx, ecx
add bl, 0x5a
xor bl, byte [esp + ecx]
add bl, 0x3e
mov byte [esp + ecx], bl
inc ecx
cmp ecx, 7
jne 0x43b070
mov ecx, dword [0x44c2b0]
test ecx, ecx
je 0x43b0e2
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x16194952
je 0x43b0b0
inc edi
cmp ecx, edi
jne 0x43b0a0
jmp 0x43b0e2
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, esi
je 0x43b0e2
lea esi, [esp + 0xc]
lea edi, [esp + 8]
push 0x8000
push esi
push edi
push 0xffffffffffffffff
push 4
push ecx
push dword [0x44c2b8]
mov esi, eax
mov edi, edx
call fcn.0043ca30
mov edx, edi
mov eax, esi
add esp, 0x1c
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x43c970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44a1f8]
Function at 0x43d920
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp + 8], 0xe3e20b3d
mov byte [esp + 0xc], 0
mov ecx, 0xa9f6fc28
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0x560903e0]
xor edx, ecx
mov esi, edx
xor esi, 0x51d2ecc8
mov edi, edx
or edi, 0x28241037
and edi, esi
add edi, edi
xor edx, 0xae2d1337
mov esi, edi
and esi, edx
xor edx, edi
lea edx, [edx + esi*2]
inc dl
mov byte [esp + ecx + 0x560903e0], dl
inc ecx
cmp ecx, 0xa9f6fc2d
jne 0x43d950
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
mov eax, dword [ecx*4 + 0x44a5d4]
mov ecx, 0x6ffce039
xor ecx, dword [0x44a5dc]
add eax, ecx
inc eax
jmp eax
Function at 0x43e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
add ecx, ebp
mov edx, edi
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x28]
jb 0x43e222
mov ecx, ebx
shr ecx, 2
mov eax, ebp
mov edi, esi
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
shr ecx, 1
and ecx, 1
mov eax, edx
mov edi, esi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
test bl, 1
je 0x43e35e
and ebx, 2
movzx ecx, byte [edx + ebx]
mov byte [esi + ebx], cl
jmp 0x43e35e
mov dword [esp], 0x80878685
mov word [esp + 4], 0
mov byte [esp + 6], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x61
xor cl, byte [esp + eax]
add cl, 0x1b
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43e240
mov eax, dword [esp]
mov ecx, dword [0x44c2b0]
test ecx, ecx
je 0x43e2b2
xor edx, edx
mov edi, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x89c57e52
je 0x43e284
inc edx
cmp ecx, edx
jne 0x43e270
mov edi, dword [esp + 0x24]
jmp 0x43e2b2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
mov edi, dword [esp + 0x24]
je 0x43e2b2
lea eax, [esp + 8]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push ecx
push dword [0x44c2b8]
call fcn.0043ca30
add esp, 0x28
test eax, eax
js 0x43e35e
push 0x732f71fd
push dword [0x4542cc]
call fcn.0043f9e0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x20]
call eax
mov ecx, dword [esp + 8]
mov dword [esp], 0x80878685
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0x61
xor bl, byte [esp + edx]
add bl, 0x1b
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43e300
mov edx, dword [0x44c2b0]
test edx, edx
je 0x43e35e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44c2b4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb62b8d10
je 0x43e340
inc edi
cmp edx, edi
jne 0x43e330
jmp 0x43e35e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43e35e
push ecx
push 1
push edx
push dword [0x44c2b8]
mov esi, eax
call fcn.0043ca30
mov eax, esi
add esp, 0x10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f9e0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov ecx, dword [ebp + 8]
push eax
push eax
mov eax, esp
movzx ecx, word [ecx]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x23228b7d
mov word [ebp - 0x14], 0
mov edx, 0x6cd76620
mov esi, 0x93289a08
nop
nop
nop
movzx ecx, byte [ebp + esi + 0x6cd765e0]
mov edi, esi
and edi, ecx
add edi, edi
mov ebx, ecx
sub ebx, edi
add ebx, esi
add ebx, 0x2034fdd7
sub edi, ecx
mov ecx, ebx
add edi, edx
and edi, 0x4f
and ebx, 0xb0
or ebx, edi
and ecx, 1
xor ebx, 0x4e
lea ecx, [ebx + ecx*2]
mov byte [ebp + esi + 0x6cd765e0], cl
dec edx
inc esi
cmp edx, 0x6cd7661a
jne 0x43fa10
xor ecx, ecx
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 0x18], edx
setne cl
jmp dword [ecx*4 + 0x44ad84]
Function at 0x42b5e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x42b602
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42b609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42b5f8
mov eax, 1
add ebx, ebx
jne 0x42b61b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42b610
jne 0x42b62c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b610
xor ecx, ecx
sub eax, 3
jb 0x42b640
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42b6b2
mov ebp, eax
add ebx, ebx
jne 0x42b64b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42b658
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42b67c
inc ecx
add ebx, ebx
jne 0x42b668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42b65d
jne 0x42b679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b65d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42b69c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42b68d
jmp 0x42b5fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42b69c
add edi, ecx
jmp 0x42b5fe
pop esi
mov edi, esi
mov ecx, 0x3e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42b6ba
cmp byte [edi], 1
jne 0x42b6ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42b6bf
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42b737
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c688]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c73c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42b6ec
mov ecx, edi
jns 0x42b71b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c740]
or eax, eax
je 0x42b731
mov dword [ebx], eax
add ebx, 4
jmp 0x42b709
call dword [esi + 0x2c748]
mov ebp, dword [esi + 0x2c744]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42b76b
sub esp, 0xffffff80
jmp 0x40d841
Function at 0x401520
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4031a0
push 0x402ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
ja case.default.0x401564
mov ecx, dword [ebp - 0x28]
jmp dword [ecx*4 + 0x4016d8]
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je case.0x401564.1
jmp case.default.0x401564
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4015b9
jmp case.default.0x401564
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jbe 0x40162d
cmp dword [ebp - 0x2c], 3
jbe 0x4015d3
cmp dword [ebp - 0x2c], 4
je 0x401608
jmp 0x40162d
mov ecx, dword [ebp + 0x18]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x401606
mov dword [ebp - 0x1c], 1
jmp 0x40162d
push 4
lea eax, [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40162d
mov dword [ebp - 0x1c], 1
jmp case.default.0x401564
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40164e
jmp case.default.0x401564
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401667
mov dword [ebp - 0x1c], 1
jmp case.default.0x401564
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401688
jmp case.default.0x401564
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne case.default.0x401564
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.004016af
jmp 0x4016c4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4016f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x401708
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x401762
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x401729
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x401753
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x401749
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x401751
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x401720
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x42c740], ecx
jmp 0x4016ff
mov esp, ebp
pop ebp
ret

Function at 0x4018d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x401b30
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x15180
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov dword [ebp - 0x20], 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x2c]
push edx
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Create directory
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jae 0x401d57
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._temp
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.004018d0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401d2c
push str.c:_temp
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
push 0x42c580
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [ebp + 0xc]
push ecx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 0xc]
push edx
call fcn.004018d0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401d78
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401e60
Capabilities:
Delete service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push edi
mov byte [ebp - 0x28], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 0x68], 0
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x67]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x28]
push eax
call fcn.00401c40
add esp, 8
mov dword [ebp - 0x34], 0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x42d144
push str.Globalki
lea eax, [ebp - 0x68]
push eax
call fcn.004023f0
add esp, 8
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.00402420
add esp, 8
push 0x42c6a4
lea eax, [ebp - 0x68]
push eax
call fcn.00402420
add esp, 8
lea ecx, [ebp - 0x68]
push ecx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x34]
push edx
push 2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x401f30
push 0x2ee0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401f2c
cmp dword [ebp - 8], 0
jne 0x401f30
mov byte [ebp - 4], 1
mov edx, dword [ebp - 4]
and edx, 0xff
test edx, edx
jne 0x401f6b
lea eax, [ebp - 0x84]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [ebp - 0x80], 1
je 0x401f61
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x401f80
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
test eax, eax
je 0x401fa3
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebp
ret
Function at 0x401fd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403180
push 0x402ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x402035
mov byte [ebp - 0x39], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x39]
jmp 0x40219e
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x402097
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
test edx, edx
je 0x402097
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x402097
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402156
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x402144
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x402111
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40210f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40210f
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [ebp - 0x3a], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3a]
jmp 0x40219e
jmp 0x40213e
mov eax, dword [ebp - 0x20]
and eax, 0x10
cmp eax, 0x10
je 0x40213e
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [ebp - 0x3b], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3b]
jmp 0x40219e
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0x5c
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1c], eax
jmp 0x402097
mov dword [ebp - 4], 0xffffffff
jmp 0x40218a
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret