joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433a51
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0xc]
mov ecx, 0
mov dword [eax], ecx
call sub.cvirte.dll_GetBreakOnLibraryErrors
lea ecx, [ebp - 0x10]
mov dword [ecx], eax
call sub.cvirte.dll_DisableBreakOnLibraryErrors
mov eax, dword [ebp + 0xc]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.cvirte.dll_GetFileInfo
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0xffffffff
cmp eax, ecx
je 0x433b4e
mov ecx, 0
cmp eax, ecx
je 0x433aff
mov ecx, 1
cmp eax, ecx
je 0x433abc
jmp 0x433b6d
lea eax, [0x77eac0]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.cvirte.dll_fopen
add esp, 8
lea ecx, [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
je 0x433b87
mov eax, dword [ebp - 4]
push eax
call sub.cvirte.dll_fclose
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, 1
mov dword [eax], ecx
jmp 0x433b87
lea eax, [0x7807b4]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.cvirte.dll_fopen
add esp, 8
lea ecx, [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
je 0x433b87
mov eax, dword [ebp - 4]
push eax
call sub.cvirte.dll_fclose
add esp, 4
mov eax, dword [ebp + 8]
push eax
call sub.cvirte.dll_remove
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, 1
mov dword [eax], ecx
jmp 0x433b87
lea eax, [ebp - 0xc]
mov ecx, 0xffffffa5
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, 0
cmp eax, ecx
jge 0x433b87
jmp 0x433b87
lea eax, [ebp - 0xc]
mov ecx, 0xffffffa3
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, 0
cmp eax, ecx
jge 0x433b87
mov eax, dword [ebp - 0x10]
mov ecx, 0
cmp eax, ecx
je 0x433b9c
call sub.cvirte.dll_EnableBreakOnLibraryErrors
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 8

Function at 0x433dee
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
call sub.cvirte.dll_GetBreakOnLibraryErrors
lea ecx, [ebp - 4]
mov dword [ecx], eax
call sub.cvirte.dll_DisableBreakOnLibraryErrors
mov eax, dword [ebp + 8]
push eax
call sub.cvirte.dll_remove
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, 0
cmp eax, ecx
je 0x433e25
call sub.cvirte.dll_EnableBreakOnLibraryErrors
pop esi
leave
ret 4
Function at 0x43db98
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
lea eax, [ebp - 0x110]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [0x77aa38]
mov ecx, 0
cmp eax, ecx
je 0x43dbcc
mov eax, 0
jmp 0x43dd40
call sub.KERNEL32.dll_GetCurrentProcessId
lea ecx, [ebp - 4]
mov dword [ecx], eax
lea eax, str.NI_CVI_Programmers_Toolbox_library_lock_on_KERNEL32.DLL_handle____d
lea ecx, [ebp - 0x10c]
mov edx, dword [ebp - 4]
push edx
push eax
push ecx
call sub.cvirte.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
lea ecx, [ebp - 0x110]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43dc25
mov eax, 0xffffec1b
jmp 0x43dd40
push 0xffffffff
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [0x77aa38]
mov ecx, 0
cmp eax, ecx
je 0x43dc6b
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
jmp 0x43dd40
lea eax, str.kernel32.dll
push eax
call sub.KERNEL32.dll_LoadLibraryA
lea ecx, [0x77aa34]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43dcae
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffec1b
jmp 0x43dd40
lea eax, str.GetDiskFreeSpaceExA
push eax
mov eax, dword [0x77aa34]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x458704]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43dcdb
jmp 0x43dd0a
lea eax, [0x77aa38]
mov ecx, 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
jmp 0x43dd40
mov eax, dword [0x77aa34]
push eax
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x77aa34]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffec1a
pop esi
leave
ret
Function at 0x43dd44
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
lea eax, [ebp - 0x110]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [0x77aa40]
mov ecx, 0
cmp eax, ecx
je 0x43dd78
mov eax, 0
jmp 0x43dfd3
call sub.KERNEL32.dll_GetCurrentProcessId
lea ecx, [ebp - 0x10c]
mov dword [ecx], eax
lea eax, str.NI_CVI_Programmers_Toolbox_library_lock_on_SHELL32.DLL_handle____d
lea ecx, [ebp - 0x108]
mov edx, dword [ebp - 0x10c]
push edx
push eax
push ecx
call sub.cvirte.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
lea ecx, [ebp - 0x110]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43ddd7
mov eax, 0xffffec1b
jmp 0x43dfd3
push 0xffffffff
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [0x77aa40]
mov ecx, 0
cmp eax, ecx
je 0x43de1d
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
jmp 0x43dfd3
lea eax, str.shell32.dll
push eax
call sub.KERNEL32.dll_LoadLibraryA
lea ecx, [0x77aa3c]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43de60
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffec1b
jmp 0x43dfd3
lea eax, str.DragQueryFile
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x45870c]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43de8d
jmp 0x43df9d
lea eax, str.DragQueryPoint
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x458708]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43deba
jmp 0x43df9d
lea eax, str.DragAcceptFiles
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x458714]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43dee7
jmp 0x43df9d
lea eax, str.DragFinish
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x458710]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43df14
jmp 0x43df9d
lea eax, str.Shell_NotifyIconA
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x458718]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43df41
jmp 0x43df9d
lea eax, str.ShellExecuteExA
push eax
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_GetProcAddress
lea ecx, [0x45871c]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
jne 0x43df6e
jmp 0x43df9d
lea eax, [0x77aa40]
mov ecx, 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0
jmp 0x43dfd3
mov eax, dword [0x77aa3c]
push eax
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x77aa3c]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [ebp - 0x110]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffec1a
pop esi
leave
ret
Function at 0x43e915
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
push esi
lea eax, [ebp - 4]
mov ecx, 0
mov dword [eax], ecx
call sub.cvirte.dll_GetCurrentPlatform
mov ecx, 3
cmp eax, ecx
jne 0x43e94c
lea eax, [ebp - 0x20]
mov ecx, 0
mov dword [eax], ecx
lea eax, [0x43e956]
jmp eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov dword [eax], ecx
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0
cmp eax, ecx
jne 0x43e97d
lea eax, [ebp - 4]
mov ecx, 0xffffffbf
mov dword [eax], ecx
jmp 0x43ea86
mov eax, dword [ebp + 0x14]
mov ecx, 0
cmp eax, ecx
jne 0x43e99c
lea eax, [ebp - 4]
mov ecx, 0xffffffbf
mov dword [eax], ecx
jmp 0x43ea86
lea eax, [0x77e9c4]
mov ecx, dword [ebp + 0xc]
push 0
push 0x3535
push eax
push ecx
call fcn.004201e8
lea eax, [0x77e9b8]
mov ecx, dword [ebp + 0x14]
push 0
push 0x3536
push eax
push ecx
call fcn.004201e8
lea eax, [ebp - 0x14]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x10]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x18]
mov ecx, 0xc
mov dword [eax], ecx
lea eax, [ebp - 0xc]
lea ecx, [ebp - 8]
lea edx, [ebp - 0x18]
lea ebx, str.DfltClass
mov edi, dword [ebp + 8]
push eax
push ecx
push edx
push 2
push 0
push ebx
push 0
mov eax, dword [ebp + 0xc]
push eax
push edi
call sub.ADVAPI32.dll_RegCreateKeyExA
mov ecx, 0
cmp eax, ecx
je 0x43ea39
lea eax, [ebp - 4]
mov ecx, 0xffffec37
mov dword [eax], ecx
jmp 0x43ea86
mov eax, dword [ebp + 0x14]
push eax
call sub.cvirte.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x1c]
add eax, ecx
push eax
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
mov ecx, 0
cmp eax, ecx
je 0x43ea7d
lea eax, [ebp - 4]
mov ecx, 0xffffec36
mov dword [eax], ecx
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x43ed12
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 0x10]
mov ecx, 0
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, 0
cmp eax, ecx
jne 0x43ed4c
lea eax, [ebp - 4]
mov ecx, 0xffffffbf
mov dword [eax], ecx
jmp 0x43eef3
mov eax, dword [ebp + 0x1c]
mov ecx, 0
cmp eax, ecx
jne 0x43ed6b
lea eax, [ebp - 4]
mov ecx, 0xffffffbf
mov dword [eax], ecx
jmp 0x43eef3
lea eax, [0x77e97c]
mov ecx, dword [ebp + 0xc]
push 0
push 0x3595
push eax
push ecx
call fcn.004201e8
lea eax, [0x77e970]
mov ecx, dword [ebp + 0x1c]
push 0
push 0x3596
push eax
push ecx
call fcn.004201e8
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 8]
push eax
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
push ecx
call sub.ADVAPI32.dll_RegOpenKeyExA
lea ecx, [ebp - 8]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
je 0x43ee05
mov eax, dword [ebp - 8]
mov ecx, 2
cmp eax, ecx
jne 0x43edee
lea eax, [ebp - 0x14]
mov ecx, 0xffffec32
mov dword [eax], ecx
lea eax, [0x43edf8]
jmp eax
lea eax, [ebp - 0x14]
mov ecx, 0xffffec37
mov dword [eax], ecx
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x43eef3
lea eax, [ebp - 0xc]
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
push eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
lea ecx, [ebp - 8]
mov dword [ecx], eax
mov ecx, 0
cmp eax, ecx
je 0x43ee6f
mov eax, dword [ebp - 8]
mov ecx, 2
cmp eax, ecx
jne 0x43ee58
lea eax, [ebp - 0x14]
mov ecx, 0xffffec34
mov dword [eax], ecx
lea eax, [0x43ee62]
jmp eax
lea eax, [ebp - 0x14]
mov ecx, 0xffffec35
mov dword [eax], ecx
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x43eef3
mov eax, dword [ebp - 0xc]
mov ecx, 1
cmp eax, ecx
je 0x43ee8e
lea eax, [ebp - 4]
mov ecx, 0xffffec33
mov dword [eax], ecx
jmp 0x43eef3
mov eax, dword [ebp + 0x14]
mov ecx, 0
cmp eax, ecx
je 0x43eef3
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x18]
cmp eax, ecx
jbe 0x43eebd
lea eax, [ebp - 4]
mov ecx, 0xffffffc7
mov dword [eax], ecx
jmp 0x43eef3
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, 0
cmp eax, ecx
je 0x43eef3
lea eax, [ebp - 4]
mov ecx, 0xffffec35
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov ecx, 0
cmp eax, ecx
je 0x43ef0c
mov eax, dword [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
leave
ret 0x18
Function at 0x44ddc2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
mov ecx, 0xc
add eax, ecx
lea ecx, [ebp - 8]
mov eax, dword [eax]
mov byte [ecx], al
lea eax, [ebp - 8]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 1
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, 8
add eax, ecx
lea ecx, [ebp - 8]
mov eax, dword [eax]
mov byte [ecx], al
lea eax, [ebp - 8]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 1
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
lea eax, [ebp - 8]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov byte [eax], cl
lea eax, [ebp - 8]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 1
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
lea eax, [ebp - 8]
mov ecx, 0
mov byte [eax], cl
lea eax, [ebp - 8]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 1
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, 0
mov dword [eax], ecx
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 4
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 4
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 4
push eax
call sub.cvirte.dll_fwrite
add esp, 0x10
mov eax, 0
pop esi
leave
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1dc863f0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x449e777c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401449
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x40148c
mov edx, dword [ecx + 0xc]
inc eax
push ebx
push edi
mov dword [ebp + 8], eax
mov eax, dword [ecx + 4]
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
inc esi
shr eax, 8
mov edi, dword [edx + edi*4]
xor eax, edi
dec dword [ebp + 8]
mov dword [ecx + 4], eax
jne 0x401469
pop edi
pop ebx
mov eax, dword [ecx + 4]
pop esi
pop ebp
ret 0xc

Function at 0x401dae
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
call fcn.00401f19
push 4
call fcn.004058e6
test eax, eax
pop ecx
je 0x401e88
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
push dword [0x524a80]
call esi
test eax, eax
je 0x401e01
push 1
pop eax
jmp 0x401e8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x401e81
cmp dword [ebp - 4], ebx
je 0x401e81
push dword [ebp - 4]
call fcn.004b0861
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x401e28
call fcn.004c3a95
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x524a80]
call esi
push eax
mov ecx, edi
call fcn.0040588d
mov esi, eax
cmp esi, ebx
je 0x401e74
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 0xc]
call fcn.00401f3f
mov dword [edi + 0x38], ebx
push dword [edi + 0x14]
lea ecx, [edi + 0xc]
call fcn.004c76a3
push dword [ebp - 0xc]
call fcn.004b0778
pop ecx
mov eax, esi
jmp 0x401e8a
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403ec5
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, 0x4d8708
call fcn.004b0604
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 0x10]
push edi
xor ebx, ebx
push eax
mov dword [esi + 0x28], ebx
call fcn.00403c11
mov eax, dword [eax]
xor ecx, ecx
cmp dword [eax - 8], ebx
sete cl
mov edi, ecx
lea ecx, [ebp - 0x10]
call fcn.004c756a
cmp edi, ebx
je 0x403fa9
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00403bed
cmp dword [esi + 0x20], ebx
mov dword [ebp - 4], ebx
jne 0x403f39
mov ecx, esi
call fcn.00405151
test eax, eax
jne 0x403f39
cmp dword [esi + 0x28], ebx
lea ecx, [ebp - 0x10]
setge al
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004c756a
mov eax, esi
jmp 0x404036
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
je 0x403f6e
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x10]
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.004c3dc8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004c76a3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004c756a
mov ecx, esi
call fcn.0040523d
push dword [ebp - 0x10]
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
and eax, 0xffff
or eax, 0x80070000
mov ecx, esi
neg edi
sbb edi, edi
and edi, eax
call fcn.00404045
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x28], edi
lea ecx, [ebp - 0x10]
jmp 0x404029
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.00403c11
push 2
pop edi
push dword [0x4e7cc0]
mov dword [ebp - 4], edi
push dword [ebp - 0x14]
call fcn.004b10d5
pop ecx
test eax, eax
pop ecx
jne 0x403fd6
lea ecx, [ebp - 0x14]
call fcn.004c74f5
cmp dword [esi + 0x24], ebx
jne 0x404001
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
mov ecx, esi
call fcn.00403d84
test eax, eax
jne 0x404001
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
mov ecx, esi
call fcn.00403d84
test eax, eax
je 0x404022
push dword [ebp - 0x14]
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004c756a
xor eax, eax
cmp dword [esi + 0x28], ebx
setge al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40440b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4d8794
call fcn.004b0604
sub esp, 0x10
push ebx
push esi
push dword [ebp + 0xc]
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp + 0xc]
mov dword [esi + 0x28], ebx
call fcn.004c75d8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jne 0x40445a
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00403c11
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004c76a3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004c756a
push dword [0x4e7cc0]
push dword [ebp + 0xc]
call fcn.004b10d5
pop ecx
test eax, eax
pop ecx
jne 0x404476
lea ecx, [ebp + 0xc]
call fcn.004c74f5
cmp dword [esi + 0x24], ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
jne 0x4044b0
push ebx
push ebx
push ebx
push ebx
push 0xf003f
push ebx
mov ecx, esi
call fcn.00403d84
test eax, eax
jne 0x4044b0
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
mov ecx, esi
call fcn.00403d84
test eax, eax
je 0x40456a
lea eax, [ebp - 0x10]
lea ecx, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push ebx
call fcn.004c799a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [esi + 0x24]
call edi
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
push 0xffffffffffffffff
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
lea ecx, [ebp + 0xc]
call fcn.004c79e9
cmp dword [esi + 0x28], ebx
jl 0x40456a
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x404506
cmp eax, dword [ebp - 0x18]
je 0x404506
mov dword [esi + 0x28], 0x8007000d
cmp dword [esi + 0x28], ebx
jl 0x40456a
cmp dword [ebp + 8], ebx
je 0x404576
cmp dword [ebp - 0x10], ebx
jbe 0x40456a
push dword [ebp - 0x10]
call fcn.004c67ee
pop ecx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x18]
lea ecx, [ebp + 0xc]
push eax
push ebx
push ebx
call fcn.004c799a
push eax
push dword [esi + 0x24]
call edi
mov ecx, eax
and eax, 0xffff
or eax, 0x80070000
push 0xffffffffffffffff
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esi + 0x28], ecx
lea ecx, [ebp + 0xc]
call fcn.004c79e9
cmp dword [esi + 0x28], ebx
jge 0x40456a
push dword [ebp - 0x14]
call fcn.004c6817
pop ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x404576
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
pop edi
cmp eax, ebx
je 0x404583
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x40458f
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
cmp dword [esi + 0x28], ebx
lea ecx, [ebp + 0xc]
setge al
or dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.004c756a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14