joyce8/EMBER2024-capa huggingface dataset:
Function at 0x342de2ab
Capabilities:
Get hostname

Disassembly:
sub esp, 0x6ec
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x6e8], eax
mov eax, dword [esp + 0x6f4]
push ebp
mov ebp, dword [esp + 0x6f4]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x32
call fcn.342d9618
test eax, eax
jne 0x342de2fc
pop ebp
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.341f1b18
add esp, 0x6ec
ret 0xc
push ebx
push esi
push edi
lea edi, [ebp + 4]
push 0x5c
push edi
call dword [sym.imp.msvcr80.dll_wcschr]
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6877]
mov esi, eax
add esp, 8
test esi, esi
je 0x342de32e
push 0x32
lea ecx, [esp + 0x1c]
push ecx
push edi
mov word [esi], 0
call ebx
mov word [esi], 0x5c
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x80]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x342de378
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x342de34b
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.341f8750
add esp, 0xc
test eax, eax
jne 0x342de46c
mov esi, dword [sym.imp.msvcr80.dll_wcschr]
push 0x5c
push edi
call esi
xor edi, edi
add esp, 8
cmp eax, edi
je 0x342de465
add eax, 2
push 0x5c
push eax
call esi
add esp, 8
mov esi, eax
cmp esi, edi
push 0x104
je 0x342de3ce
lea eax, [esp + 0x4f4]
push eax
lea ecx, [esi + 2]
push ecx
mov word [esi], di
call ebx
push 0x104
lea edx, [esp + 0x2ec]
push edx
push ebp
call ebx
mov word [esi], 0x5c
jmp 0x342de3e1
lea eax, [esp + 0x2ec]
push eax
push ebp
call ebx
mov word [esp + 0x4f0], di
push 0x104
lea ecx, [esp + 0xe4]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.342de231
test eax, eax
je 0x342de45c
lea eax, [esp + 0xe0]
push eax
call fcn.342d929d
test eax, eax
je 0x342de45c
push 0x104
lea ecx, [esp + 0xe4]
push ecx
call fcn.342d92f0
mov esi, dword [esp + 0x708]
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x4f0]
push edx
lea eax, [esp + 0xe4]
push eax
push 0x342c5764
push esi
push ebx
call fcn.342d38b8
add esp, 0x14
cmp esi, edi
je 0x342de455
mov word [ebx + esi*2 - 2], di
mov eax, 1
jmp 0x342de46e
mov ecx, dword [esp + 0x10]
mov word [ecx], di
jmp 0x342de46c
mov edx, dword [esp + 0x10]
mov word [edx], di
xor eax, eax
mov ecx, dword [esp + 0x6f8]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.341f1b18
add esp, 0x6ec
ret 0xc
Function at 0x342de489
Capabilities:
Get hostname

Disassembly:
sub esp, 0x48c
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x488], eax
mov eax, dword [esp + 0x494]
push ebx
mov ebx, dword [esp + 0x4a4]
push ebp
mov ebp, dword [esp + 0x498]
push esi
mov esi, dword [esp + 0x4a8]
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
xor edi, edi
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x32
call sub.kernel32.dll_GetComputerNameW
cmp dword [esi], edi
jne 0x342de517
push 0x1000
call sub.MSO.dll_Ordinal_815
cmp eax, edi
mov dword [esi], eax
jne 0x342de4f9
xor eax, eax
jmp 0x342de601
call fcn.342d9214
cmp ax, 1
push ebx
jne 0x342de50f
mov eax, dword [esi]
push eax
call fcn.342dd9cb
jmp 0x342de517
mov ecx, dword [esi]
push ecx
call fcn.342dde44
cmp eax, edi
je 0x342de5fd
cmp dword [esi], edi
je 0x342de5fd
cmp dword [ebx], edi
jbe 0x342de5fd
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x105
lea edx, [esp + 0x290]
push edx
add ecx, 0x209
push ecx
call fcn.34344731
test eax, eax
je 0x342de4f2
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x105
lea edx, [esp + 0x84]
push edx
push ecx
call fcn.34344731
test eax, eax
je 0x342de4f2
push 1
push ebp
lea edx, [esp + 0x294]
push edx
call fcn.342d94c1
test eax, eax
je 0x342de58a
add edi, 1
cmp edi, dword [ebx]
jae 0x342de5fd
jmp 0x342de52f
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x342de591
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x80]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x342de5ac
sub eax, esi
mov esi, dword [esp + 0x4a8]
sar eax, 1
lea eax, [eax + edx + 3]
cmp eax, esi
ja 0x342de5fd
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x342de61c
push esi
push edi
call fcn.342d38b8
add esp, 0x14
test esi, esi
je 0x342de5f5
mov word [edi + esi*2 - 2], 0
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x498]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.341f1b18
add esp, 0x48c
ret 0x14
Function at 0x342e2f91
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [edx + 0x10]
cmp edx, ecx
push edi
mov dword [esi], 0
mov eax, edx
jae 0x342e2fb7
mov edi, dword [eax]
xor dword [esi], edi
add eax, 4
cmp eax, ecx
jb 0x342e2fac
mov ebx, dword [edx]
mov ebp, dword [esp + 0x18]
or ebx, 1
xor edi, edi
mov eax, dword [esp + 0x14]
push esi
push ebp
push eax
call fcn.342e14b4
test eax, eax
jne 0x342e2feb
add dword [esi], ebx
add edi, 1
cmp edi, 0x7fffffff
jl 0x342e2fc2
pop edi
pop esi
pop ebp
mov eax, 0xffffb1bc
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x342ec836
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x220
mov eax, dword [0x342226fc]
xor eax, esp
mov dword [esp + 0x21c], eax
cmp dword [esp + 0x228], 0x28
push ebp
mov eax, ecx
mov ecx, dword [esp + 0x230]
mov ebp, dword [eax + 4]
push edi
mov edi, dword [esp + 0x22c]
jae 0x342ec87a
push 1
push 0xfffffbe9
call fcn.341f7675
jmp 0x342ec917
push ebx
push esi
push 0
push 0x6b39dac7
lea ecx, [esp + 0x1c]
call fcn.341f52e4
push 0
push 0x6b39dac7
lea ecx, [esp + 0x128]
call fcn.341f52e4
lea eax, [ebp + 0x18]
push 0x80
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.34313bc0
fld qword [ebp + 0x72]
lea ebx, [ebp + 0x42]
call fcn.341f5463
mov edx, 4
mov ecx, ebx
sub edx, ebx
xor dword [ecx], eax
add ecx, 4
lea esi, [edx + ecx]
cmp esi, 0x28
jle 0x342ec8c9
mov ecx, 0xa
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
fld qword [ebp + 0x72]
call fcn.341f5463
mov edx, 4
mov ecx, ebx
sub edx, ebx
lea ebx, [ebx]
xor dword [ecx], eax
add ecx, 4
lea esi, [edx + ecx]
cmp esi, 0x28
jle 0x342ec8f2
mov eax, dword [esp + 0x10]
push 0x80
push eax
lea ecx, [esp + 0x128]
call fcn.34313bc0
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
pop edi
pop ebp
xor ecx, esp
call fcn.341f1b18
add esp, 0x220
ret 0xc
Function at 0x342f1000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebx
push 8
push ebp
mov edi, ecx
xor esi, esi
call fcn.342f09e0
test byte [ebx], 4
jne 0x342f108c
mov ecx, dword [edi + 4]
mov edi, dword [esp + 0x18]
neg eax
sbb al, al
lea ecx, [ecx + ebp + 1]
and eax, 0xff
movzx ebx, al
movzx edx, byte [ecx + 8]
xor edx, ebx
cmp edx, 8
jbe 0x342f1045
mov edx, 8
lea ebp, [edx + esi]
cmp ebp, dword [esp + 0x1c]
ja 0x342f107c
test edx, edx
jbe 0x342f1065
mov esi, edx
mov dl, byte [ecx]
xor dl, al
mov byte [edi], dl
add edi, 1
add ecx, 1
sub esi, 1
jne 0x342f1054
mov dl, byte [ecx]
xor dl, al
add ecx, 1
cmp dl, 8
mov esi, ebp
ja 0x342f1035
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, dword [esp + 0x20]
push 1
push 0xfffffbf2
call fcn.341f7675
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x342f1095
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebx
push 9
push ebp
mov esi, ecx
mov edi, 1
call fcn.342f09e0
test byte [ebx], 4
jne 0x342f10d9
mov ecx, dword [esi + 4]
neg eax
sbb al, al
lea ecx, [ecx + ebp + 1]
and eax, 0xff
mov dl, byte [ecx + 8]
add ecx, 8
xor dl, al
add edi, 9
add ecx, 1
cmp dl, 8
ja 0x342f10c6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x342f231b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
or eax, 0xffffffff
xor ebp, ebp
push esi
mov esi, ecx
mov ecx, 1
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], ecx
mov ecx, 5
lea eax, [esi + 0x3c]
push edi
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x64], 2
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x74], ebp
mov dword [esi + 0x78], 3
mov dword [esi + 0x7c], 4
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], ebp
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x90], 5
mov dword [esi + 0x94], 6
mov dword [esi + 0x98], ebp
mov dword [esi + 0x9c], ebp
mov dword [esi + 0xa8], 7
mov dword [esi + 0xac], 8
mov dword [esi + 0xb0], ebp
mov dword [esi + 0xb4], ebp
mov dword [esi + 0xc0], 9
mov dword [esi + 0xc4], 0xa
mov dword [esi + 0xc8], ebp
mov dword [esi + 0xcc], ebp
mov dword [esp + 0x14], ecx
mov ebx, 0xc
mov dword [esp + 0x10], eax
lea edi, [esi + 0xd4]
lea eax, [ecx - 1]
cdq
sub eax, edx
sar eax, 1
mov dword [edi], eax
mov eax, dword [esp + 0x10]
lea edx, [ebx - 1]
mov dword [edi - 4], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov eax, dword [eax]
mov dword [edi + 0xc], eax
cmp dword [eax + 0x8c], ebp
jne 0x342f243a
mov ecx, eax
call fcn.342f2b16
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x10], eax
jmp 0x342f243d
mov dword [edi + 0x10], ebp
add dword [esp + 0x10], 4
add ecx, 1
add ebx, 2
add edi, 0x18
cmp ebx, 0x16
mov dword [esp + 0x14], ecx
jle 0x342f2403
cmp dword [esi + 0x68], ebp
jne 0x342f2488
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x60]
push edi
push ecx
mov ecx, esi
call fcn.342f22ca
test byte [edi], 8
jne 0x342f2488
mov edx, dword [esi + 0x64]
push edi
push edx
mov ecx, esi
call fcn.342f22ca
test byte [edi], 8
jne 0x342f2488
push edi
push ebp
mov ecx, esi
call fcn.342f200d
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x34313bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x34313bcf
pop dword [ebp - 0x20]
mov eax, 0x861dce92
sub eax, 0x51ec92c3
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x50bfc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x5028
xor esi, esi
add esi, eax
mov edx, 0xb083affb
add edx, 0x83b60005
add edx, dword [ebp - 0x20]
mov ebx, 0x58c94282
sub ebx, 0xb1a025b1
mov edi, dword [edx]
sub dword [ebp - 0x18], edi
xor edi, ebx
mov dword [ebp - 8], 0x20efea36
mov dword [esi], edi
sub dword [ebp - 0xc], 0xb4222beb
add esi, 0x660b20af
sub esi, 0x660b20ab
add edx, 0xc3c7aba5
add edx, 0x3c38545f
loop 0x34313c25
add eax, 0x13373
mov ebx, eax
add eax, 5
mov ecx, sym.acecore.dll_Ordinal_58
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x3431bd4c
Capabilities:
Check for time delay via gettickcount

Disassembly:
movzx eax, ax
sub eax, 0
je 0x3431bd98
dec eax
push esi
je 0x3431bd71
dec eax
je 0x3431bd6d
dec eax
je 0x3431bd66
mov esi, dword [0x3438cc18]
jmp 0x3431bd7f
mov esi, 0x96
jmp 0x3431bd74
push 0x64
jmp 0x3431bd73
push 0x32
pop esi
mov eax, dword [0x3438cc18]
cmp eax, esi
jae 0x3431bd7f
mov esi, eax
push edi
call sub.kernel32.dll_GetTickCount
test esi, esi
mov edi, eax
jbe 0x3431bd96
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, esi
jb 0x3431bd8b
pop edi
pop esi
ret
Function at 0x34344967
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x3437c180], 0
mov dword [esp], 0
je 0x3434497c
xor eax, eax
pop ecx
ret
push 0x34344a70
call fcn.3426aafc
test eax, eax
mov dword [0x3438ed40], eax
je 0x34344a48
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x34344a60
push eax
call esi
mov dword [0x3438ed24], eax
mov eax, dword [0x3438ed40]
push 0x34344a50
push eax
call esi
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [0x3438ed28], eax
mov dword [0x3438ebd8], 0x3e8
call esi
push 0
push 0
push 0
push 0
mov dword [0x3438ed2c], eax
call esi
push 0x3438ecd0
mov dword [0x3438ed30], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
cmp dword [0x3438ed2c], 0
pop esi
je 0x34344a48
cmp dword [0x3438ed30], 0
je 0x34344a48
lea ecx, [esp]
push ecx
push 0
push 0
push 0x3434477b
push 0
push 0
call dword [sym.imp.msvcr80.dll__beginthreadex]
mov edx, dword [0x3438ed2c]
add esp, 0x18
push 0xffffffffffffffff
push edx
mov dword [0x3438ed34], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [0x3438ed34]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop ecx
ret
mov eax, 0x80004005
pop ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x695c1d2f
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x14e6356c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40a9ef
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
xor edx, edx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi], 0x4018fc
mov dword [edi + 4], edx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
mov dword [edi + 0x28], edx
mov dword [edi + 0x2c], edx
mov dword [edi + 0x30], edx
mov dword [edi + 0x34], edx
mov dword [ebx], edx
test ecx, ecx
jne 0x40aa38
mov dword [ebx], 0x80004003
jmp 0x40aba8
cmp dword [edi + 0x20], edx
jne 0x40aa48
mov dword [ebx], 0x80070057
jmp 0x40aba8
mov eax, dword [ecx]
push esi
push ecx
mov dword [ebp - 4], edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x42d974]
call esi
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 4]
mov dword [edi + 0x2c], eax
push ecx
push 0x408190
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x42d974]
call dword [esi]
mov dword [ebx], eax
test eax, eax
jns 0x40aaa5
mov ecx, dword [ebp - 4]
mov dword [ebx], 0x80070057
test ecx, ecx
je 0x40ab15
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x42d974]
call esi
and dword [ebp - 4], 0
jmp 0x40ab15
mov eax, dword [ebp - 4]
lea ecx, [edi + 0x24]
push ecx
push 0x4080e0
push 0x407fc0
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0xc]
call dword [0x42d974]
call dword [esi + 0xc]
xor esi, esi
mov dword [ebx], eax
test eax, eax
jns 0x40ab36
cmp dword [edi + 0x24], esi
jne 0x40ab36
mov ecx, 0x80070057
cmp eax, ecx
jl 0x40aadd
mov eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ebx], eax
test ecx, ecx
je 0x40aafa
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x42d974]
call esi
and dword [ebp - 4], 0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x40ab15
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x42d974]
call esi
and dword [edi + 0x24], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x40aba7
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x42d974]
call esi
and dword [edi + 0x2c], 0
jmp 0x40aba7
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40ab52
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x42d974]
call esi
xor esi, esi
mov dword [ebp - 4], esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x34]
push eax
push esi
push edi
push 0x40c000
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x1c]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x40ab9e
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x40bae7
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov ecx, dword [ebx + 4]
cmp dword [ebx + 0xc], esi
jle 0x40bb3e
push edi
mov edi, dword [ecx + 8]
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
test edi, edi
je 0x40bb37
mov ecx, edi
call fcn.0040b788
test eax, eax
je 0x40bb29
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x40bb34
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ebx + 0xc]
jl 0x40bafc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d8d5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x403530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d92a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 8]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d942
push 0x30
push 0x401b30
push 0x401b40
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
pop esi
leave
ret 8

Function at 0x40d981
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x40d999
mov eax, 0x80004003
jmp 0x40d9f4
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x403530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d9dc
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40d9dc
xor eax, eax
jmp 0x40d9f4
push 0x30
push 0x401b80
push 0x401b90
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
pop edi
leave
ret 4

Function at 0x40d9f9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], 0x400
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x40da60
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x403530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40da60
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40da60
cmp dword [ebp - 8], esi
jbe 0x40da60
xor eax, eax
inc eax
jmp 0x40da62
xor eax, eax
pop esi
leave
ret 4
Function at 0x41158f
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x422af0
call fcn.00421b81
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov eax, dword [edi + 0x114]
xor ebx, ebx
test eax, eax
je 0x4115bc
cmp dword [edi + 0x118], ebx
je 0x4115bc
xor eax, eax
inc eax
jmp 0x411757
mov dword [ebp - 4], ebx
test eax, eax
jne 0x4115f7
push 0xc
call fcn.00420751
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4115ec
push 1
push ebx
push 0x407300
push 0x408090
mov ecx, eax
call fcn.00410d5e
jmp 0x4115ee
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [edi + 0x114], eax
push 0xc
call fcn.00420751
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x411622
mov ecx, edi
call fcn.0040c025
push eax
push 0x407f80
mov ecx, esi
call fcn.00410dc8
jmp 0x411624
mov eax, ebx
mov ecx, edi
mov byte [ebp - 4], bl
mov dword [edi + 0x118], eax
call fcn.00411966
lea ecx, [edi + 0x104]
push ecx
push eax
mov edx, dword [eax]
mov esi, dword [edx + 0x1c]
mov ecx, esi
call dword [0x42d974]
call esi
test eax, eax
js 0x41175d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x108], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push eax
push 4
push 1
push SysReAllocString
mov dword [edi + 0x10c], eax
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
cmp dword [edi + 0x108], ebx
je 0x4116f4
mov ecx, edi
call fcn.0040c025
lea ecx, [ebp - 0x18]
push ecx
push 0x408110
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x42d974]
call dword [esi]
test eax, eax
js 0x4116db
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x42d974]
call esi
mov ecx, edi
call fcn.00411966
lea ecx, [edi + 0x11c]
push ecx
push eax
push 0x407f80
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push 0x411ad0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x12c], eax
mov ecx, edi
call fcn.0040c53e
jmp 0x4115b4
call fcn.00421ae6
ret
push 0x80004005
lea ecx, [ebp - 0x14]
call fcn.0040abd5
push 0x423a04
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x417996
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 4
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x417a15
push 4
push 0x403158
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
test eax, eax
je 0x417a0e
push edi
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x417a04
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4179fd
cmp dword [edi + 4], 4
jne 0x4179fd
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop ebx
leave
ret