joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61edf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630861
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x61ef84
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x61ef45
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x61ef37
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x61ef45
add eax, 0x10
push 0x6a015a
push eax
mov dword [ebp - 0x20], eax
call fcn.004fa738
mov esi, eax
add esp, 8
test esi, esi
je 0x61ef45
push dword [ebp - 0x20]
push 0
push esi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x61eefa
push esi
call fcn.004fa508
add esp, 4
jmp 0x61ef45
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x61ef00
sub ecx, edx
sar ecx, 1
je 0x61ef2e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x61ef16
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.0040b220
push esi
call fcn.004fa508
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x61ef45
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x61ef64
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407120
int3
Function at 0x61efa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x61efc4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x61f026
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x61f026
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x61f041
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402c50
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x884], ecx
mov dword [ebp - 0x87c], 1
mov dword [ebp - 0x878], 0
push 0x3c
push 0
lea eax, [ebp - 0x874]
push eax
call fcn.00404f60
add esp, 0xc
mov dword [ebp - 0x874], 0x3c
mov dword [ebp - 0x860], 0x100
push 0x101
mov ecx, dword [ebp - 0x884]
add ecx, 8
call fcn.00403000
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x844], 0x800
push 0x801
mov ecx, dword [ebp - 0x884]
add ecx, 0xc
call fcn.00403000
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x854], 0x80
push 0x81
mov ecx, dword [ebp - 0x884]
add ecx, 0x10
call fcn.00403000
mov dword [ebp - 0x858], eax
mov dword [ebp - 0x84c], 0x80
push 0x81
mov ecx, dword [ebp - 0x884]
add ecx, 0x14
call fcn.00403000
mov dword [ebp - 0x850], eax
mov dword [ebp - 4], 0x824
mov ecx, dword [ebp - 0x878]
and ecx, 0x2e000000
mov dword [ebp - 0x880], ecx
mov edx, dword [ebp - 0x880]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x838]
push ecx
mov ecx, dword [ebp - 0x884]
add ecx, 4
call fcn.00403390
push eax
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
jne 0x402d76
mov dword [ebp - 0x87c], 0
jmp 0x402db4
lea edx, [ebp - 0x838]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x874]
push eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x402da4
mov dword [ebp - 0x87c], 0
jmp 0x402db4
mov edx, dword [ebp - 0x884]
mov ax, word [ebp - 0x85c]
mov word [edx], ax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x884]
add ecx, 8
call fcn.00403040
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x884]
add ecx, 0xc
call fcn.00403040
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x884]
add ecx, 0x10
call fcn.00403040
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x884]
add ecx, 0x14
call fcn.00403040
mov eax, dword [ebp - 0x87c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004049f0
mov esp, ebp
pop ebp
ret

Function at 0x4049f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419078]
jne 0x4049fa
repz ret
jmp fcn.00406d45
Function at 0x40e2d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004083a1
xor ebx, ebx
cmp dword [0x41abdc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40e3a5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40e310
xor eax, eax
jmp 0x40e469
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40e309
push eax
call fcn.0040833e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41abdc], eax
call esi
push eax
call fcn.0040833e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41abe0], eax
call esi
push eax
call fcn.0040833e
mov dword [0x41abe4], eax
lea eax, [ebp - 8]
push eax
call fcn.004059ee
test eax, eax
pop ecx
pop ecx
je 0x40e373
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052b2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40e3a5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040833e
cmp eax, ebx
pop ecx
mov dword [0x41abec], eax
je 0x40e3a5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040833e
pop ecx
mov dword [0x41abe8], eax
mov eax, dword [0x41abe8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40e41e
cmp dword [0x41abec], esi
je 0x40e41e
push eax
call fcn.004083aa
pop ecx
call eax
cmp eax, ebx
je 0x40e3eb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x41abec]
call fcn.004083aa
pop ecx
call eax
test eax, eax
je 0x40e3eb
test byte [ebp - 0x18], 1
jne 0x40e41e
lea eax, [ebp - 0xc]
push eax
call fcn.00405a25
test eax, eax
pop ecx
je 0x40e406
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004052b2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40e415
or dword [ebp + 0x10], 0x200000
jmp 0x40e44f
or dword [ebp + 0x10], 0x40000
jmp 0x40e44f
mov eax, dword [0x41abe0]
cmp eax, esi
je 0x40e44f
push eax
call fcn.004083aa
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40e44f
mov eax, dword [0x41abe4]
cmp eax, esi
je 0x40e44f
push dword [ebp - 4]
push eax
call fcn.004083aa
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x41abdc]
call fcn.004083aa
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410613
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00410552
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00404f60
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x410662
cmp dword [ebp - 0x1c], 5
jb 0x41067a
jmp 0x410676
cmp dword [ebp - 0x10], 1
jne 0x41067a
cmp dword [ebp - 0x1c], 4
ja 0x410676
jne 0x41067a
cmp dword [ebp - 0x18], 0
jbe 0x41067a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x415c44
call fcn.004103e8
test eax, eax
jge 0x41069b
mov byte [0x41b4c0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004049f0
add ebp, 0x78
leave
ret
Function at 0x411140
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413986
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x419078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
push 0x100000
call fcn.00404928
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x2c]
call fcn.00411840
mov dword [ebp - 4], 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_5.1__rv:8.0.1__Gecko_20100101_Firefox_8.0.1
lea ecx, [ebp - 0x2c]
call fcn.00411760
push 0x200000
push 0x415e2c
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00411990
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.00411890
lea edx, [ebp - 0x10]
push edx
push 0x100190
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00411650
lea ecx, [ebp - 0x2c]
call fcn.00411710
cmp dword [ebp - 0x10], 0
ja 0x411205
mov byte [ebp - 0x31], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004117c0
mov al, byte [ebp - 0x31]
jmp 0x411285
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x40]
call fcn.00410af0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x40]
call fcn.00410d50
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.00404ec3
add esp, 4
mov ecx, dword [ebp + 8]
call fcn.00401580
movzx eax, al
test eax, eax
jne 0x411266
mov ecx, dword [ebp + 0xc]
call fcn.00401580
movzx ecx, al
test ecx, ecx
jne 0x411266
mov dword [ebp - 0x44], 1
jmp 0x41126d
mov dword [ebp - 0x44], 0
mov dl, byte [ebp - 0x44]
mov byte [ebp - 0x39], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004117c0
mov al, byte [ebp - 0x39]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x411600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00411450
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x4115e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov esp, ebp
pop ebp
ret
Function at 0x411650
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0xc8
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x20000013
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x41168b
xor eax, eax
jmp 0x411709
cmp dword [ebp - 8], 0xc8
jne 0x411707
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4116fa
cmp dword [ebp - 0x10], 0
jne 0x4116d4
jmp 0x4116fa
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0xc]
jb 0x4116f8
xor eax, eax
jmp 0x411709
jmp 0x4116aa
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, 1
jmp 0x411709
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411bf0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411c10
xor eax, eax
jmp 0x411c20
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov esp, ebp
pop ebp
ret 4
Function at 0x412720
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41274a
jmp 0x4127d1
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 1
push 2
push 0x110
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412787
jmp 0x4127d1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4127a9
jmp 0x4127d1
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4127d1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4127e5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4127f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x4128b2
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00405740
add esp, 8
test eax, eax
jne 0x412866
mov eax, 1
jmp 0x4128c1
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x138]
push edx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x4128b0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x134], eax
jmp 0x412835
mov edx, dword [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049f0
mov esp, ebp
pop ebp
ret
Function at 0x4128f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 2
jl 0x41291d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0x41ad70
call fcn.004051b0
add esp, 8
push 0x41ad58
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1f4
lea edx, [ebp - 0x200]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 4], eax
push str.WinDatabase
push 0x41b160
call fcn.004051b0
add esp, 8
push 0x41ad70
push 0x4162b4
call fcn.00405740
add esp, 8
test eax, eax
je 0x41297d
push 0x41ad70
push 0x4162b8
call fcn.00405740
add esp, 8
test eax, eax
jne 0x412993
push 0x41b160
lea eax, [ebp - 0x200]
push eax
call fcn.00412720
add esp, 8
jmp 0x4129ba
push 0
push 0
push 0x4128d0
call fcn.0040588e
add esp, 0xc
push 0x41a118
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
push 0x41ad58
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004049f0
mov esp, ebp
pop ebp
ret
Function at 0x412e50
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x11c], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412e96
push 0x4163e8
call fcn.004050e8
add esp, 4
or eax, 0xffffffff
jmp 0x412f71
push 0xf01ff
push 0x416400
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412f17
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea ecx, [ebp - 0x117]
push ecx
call fcn.00404f60
add esp, 0xc
push str.C:Program_FilesWinCookerSoft.sys
lea edx, [ebp - 0x118]
push edx
call fcn.004051c0
add esp, 8
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 2
push 1
push 0xf01ff
push 0x41642c
push 0x416434
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
push 0xf01ff
push 0x41643c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x412f50
push str.OpenService_failed._n
call fcn.004050e8
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or eax, 0xffffffff
jmp 0x412f71
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x11c]
call fcn.00412aa0
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004049f0
mov esp, ebp
pop ebp
ret
Function at 0x4131b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x419078]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xac], ecx
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00404f60
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x98], 2
jne 0x41330c
cmp dword [ebp - 0xa4], 5
jne 0x413262
cmp dword [ebp - 0xa0], 1
jne 0x413262
movzx edx, byte [ebp - 0xe]
cmp edx, 1
jne 0x413262
mov ecx, dword [ebp - 0xac]
call fcn.00412f80
test eax, eax
je 0x413246
push str.os_is_Windows_xp_64_bit._n
call fcn.004050e8
add esp, 4
mov eax, 2
jmp 0x41330e
push str.os_is_Windows_xp_32_bit._n
call fcn.004050e8
add esp, 4
mov eax, 1
jmp 0x41330e
cmp dword [ebp - 0xa4], 6
jne 0x4132b8
cmp dword [ebp - 0xa0], 1
jne 0x4132b8
movzx eax, byte [ebp - 0xe]
cmp eax, 1
jne 0x4132b8
mov ecx, dword [ebp - 0xac]
call fcn.00412f80
test eax, eax
je 0x4132a2
push str.os_is_Windows_7_64_bit._n
call fcn.004050e8
add esp, 4
mov eax, 4
jmp 0x41330e
push str.os_is_Windows_7_32_bit._n
call fcn.004050e8
add esp, 4
mov eax, 3
jmp 0x41330e
cmp dword [ebp - 0xa4], 6
jne 0x41330c
cmp dword [ebp - 0xa0], 2
jne 0x41330c
movzx ecx, byte [ebp - 0xe]
cmp ecx, 1
jne 0x41330c
mov ecx, dword [ebp - 0xac]
call fcn.00412f80
test eax, eax
je 0x4132f8
push str.os_is_Windows_8_64_bit._n
call fcn.004050e8
add esp, 4
mov eax, 6
jmp 0x41330e
push str.os_is_Windows_8_32_bit._n
call fcn.004050e8
add esp, 4
mov eax, 5
jmp 0x41330e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049f0
mov esp, ebp
pop ebp
ret
Function at 0x402990
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4029cd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x4029ed
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040451c
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x402b80
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042ac
test esi, esi
jne 0x402bb6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040439c
jmp 0x402bd4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a94
mov edi, eax
test esi, esi
je 0x402bd4
cmp dword [ebx], 0
je 0x402bd4
dec esi
jmp 0x402bbd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e88
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4d1008], 0x8088405
inc edx
mov dword [ebx + 0x4d1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d1024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403378
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403358
xor eax, eax
push ebp
push 0x403351
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403394
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403358
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d1024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d1024], ax
mov esp, ebp
pop ebp
ret

Function at 0x40408c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d504c], 0
je 0x4040ed
cmp word [0x4d5220], 0xd7b2
jne 0x4040b5
cmp dword [0x4d5228], 0
jbe 0x4040b5
mov eax, 0x4d521c
call dword [0x4d5238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d1070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404114
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d1034], 0
jne 0x404109
push 0
push 0x4d1068
push 0x4d1070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040277c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4d504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404228
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc