joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a185
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
push 0x80000000
push dword [ebp + 8]
call fcn.0040a105
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x40a21c
push esi
push eax
call fcn.0040a163
mov esi, dword [ebp + 0x10]
test esi, esi
pop ecx
mov dword [ebp - 8], eax
je 0x40a1b7
mov dword [esi], eax
jmp 0x40a1ba
lea esi, [ebp - 8]
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x40a1e0
add eax, 0x10
push eax
lea ecx, [ebp + 0xc]
call fcn.0042add7
mov edi, dword [ebp + 0xc]
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
call fcn.0042602e
test edi, edi
je 0x40a210
and dword [ebp + 0xc], 0
push 0
lea eax, [ebp + 0xc]
push eax
push dword [esi]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x40a1ff
xor eax, eax
push 6
mov dword [esi], eax
add eax, edi
push 0
push eax
call fcn.00466780
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x40a21f
mov edi, dword [ebp + 0xc]
mov eax, edi
pop edi
leave
ret

Function at 0x40a8f2
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 8], 0x40
jb 0x40a907
mov eax, dword [esp + 4]
mov dword [ecx + 0xc], eax
cmp word [eax], 0x5a4d
je 0x40a90b
xor eax, eax
jmp 0x40a976
mov edx, dword [eax + 0x3c]
push esi
lea esi, [edx + 0xf8]
cmp dword [esp + 0xc], esi
jae 0x40a91f
xor eax, eax
jmp 0x40a975
add eax, edx
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x40a91b
mov dx, word [eax + 0x16]
test dh, 0x20
je 0x40a91b
test dl, 2
je 0x40a91b
cmp word [eax + 0x14], 0xe0
jne 0x40a91b
mov esi, dword [ecx + 0x10]
add eax, 0xf8
xor edx, edx
mov dword [ecx + 0x14], eax
cmp word [esi + 6], dx
jbe 0x40a972
add eax, 0x10
mov esi, dword [eax + 4]
add esi, dword [eax]
cmp esi, dword [esp + 0xc]
ja 0x40a91b
mov esi, dword [ecx + 0x10]
movzx esi, word [esi + 6]
inc edx
add eax, 0x28
cmp edx, esi
jl 0x40a958
xor eax, eax
inc eax
pop esi
ret 8

Function at 0x40aa70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [0x48fdf8], ebx
push esi
je 0x40aad6
cmp byte [ebp + 8], bl
je 0x40aad6
mov eax, dword [0x48ff4c]
cmp word [eax], bx
je 0x40aad6
test byte [0x490190], 2
mov esi, eax
je 0x40aab7
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [0x48fdf8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x40aad6
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 4]
push ecx
shl eax, 1
push eax
push esi
push dword [0x48fdf8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x10000
push esi
mov ecx, 0x48ff4c
call fcn.0042aeff
mov eax, dword [0x48ff4c]
mov word [eax], bx
mov dword [0x48ff54], esi
pop esi
mov dword [0x48ff50], ebx
pop ebx
leave
ret
Function at 0x40af05
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [ebp + 0x10], esi
je 0x40af3d
cdq
jmp 0x40af50
cmp dword [ebp + 0xc], esi
je 0x40af4a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x40af50
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x40b422
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x325
lea ecx, [ebp - 8]
call fcn.0042aed6
mov esi, dword [ebp - 8]
push esi
push 0x324
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
push ebx
call edi
push esi
call edi
cmp word [esi], 0
je 0x40b4b6
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [ebp - 0xc], eax
push esi
call fcn.0040af53
cmp eax, dword [ebp - 0xc]
pop ecx
jb 0x40b4a5
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x40b49f
dec eax
jne 0x40b4a5
mov ax, word [esi]
mov word [edi + 2], ax
mov cx, word [esi]
xor eax, eax
inc eax
cmp cx, word [ebx]
mov dword [ebp - 4], eax
jb 0x40b4a5
mov esi, eax
jmp 0x40b4b9
mov ax, word [esi]
mov word [edi], ax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x40b46c
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0042602e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40b9f6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, 0x47bc94
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov edi, 0x48feb8
movsx ax, byte [ebp - 2]
add eax, 0x41
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x40ba90
movsx ebx, byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.HKLMSYSTEMCurrentControlSetControlSession_ManagerEnvironmentCDROM_u_s
push eax
call esi
add esp, 0x10
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.00443030
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x218]
push str.CDROM_u
push eax
call esi
add esp, 0x10
inc byte [ebp - 1]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.00429dbf
inc byte [ebp - 2]
cmp byte [ebp - 2], 0x1a
jl 0x40ba20
cmp byte [ebp - 1], 0
pop edi
pop esi
pop ebx
jle 0x40bab4
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
push eax
push eax
push str.THREAD_Envi
call fcn.0041ff01
leave
ret
Function at 0x40bd6b
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40bd89
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
ret

Function at 0x40bdea
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
add dword [ebp + 8], 2
push esi
push edi
lea ecx, [ebp - 8]
call fcn.0042aeb8
lea ecx, [ebp - 4]
call fcn.0042aeb8
push 0x2c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
je 0x40becb
and word [edi], 0
push ebx
push 1
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov esi, 0x48feb8
mov ecx, esi
call fcn.0043b18c
mov ebx, dword [ebp - 8]
push 1
push 0
lea eax, [ebp - 4]
push eax
add edi, 2
push edi
mov ecx, esi
mov dword [ebp + 8], ebx
call fcn.0043b18c
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], esi
je 0x40be82
lea ecx, [ebp + 8]
call fcn.00409aad
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 8]
push 1
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
jmp 0x40bebe
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
shl eax, 1
push eax
push ebx
push 1
push str.RegisteredOwner
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push edi
mov ebx, 0x80000002
push ebx
call fcn.00426e2f
add esp, 0x18
push dword [ebp - 0xc]
call esi
shl eax, 1
push eax
push dword [ebp - 0xc]
push 1
push str.RegisteredOrganization
push edi
push ebx
call fcn.00426e2f
add esp, 0x18
xor esi, esi
pop ebx
jmp 0x40bece
xor esi, esi
inc esi
lea ecx, [ebp - 4]
call fcn.0042602e
lea ecx, [ebp - 8]
call fcn.0042602e
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40c36f
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jge 0x40c380
call fcn.0040c314
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [esp + 0xc]
jg 0x40c394
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
dec eax
js 0x40c3a0
inc eax
xor word [esi], di
inc esi
inc esi
dec eax
jne 0x40c398
mov eax, edi
pop edi
shl eax, 0x10
pop esi
ret

Function at 0x40c580
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x48fddc], 0
jne 0x40c5a3
push 0
push dword [0x48fde8]
push 0x40c4c8
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x48fddc], eax
ret
Function at 0x40c96d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
jne 0x40c988
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
push esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x22c], 0x22c
mov dword [ebp - 0x228], ebx
mov ecx, 0x89
lea edi, [ebp - 0x224]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40c9d7
cmp dword [ebp - 0x224], esi
je 0x40c9dd
lea eax, [ebp - 0x22c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c9c2
jmp 0x40c9e3
mov ebx, dword [ebp - 0x214]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
mov esi, ebx
jg 0x40c988
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40cac6
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push edi
je 0x40caea
cmp dword [ebp + 0xc], 2
jne 0x40cb19
mov edi, dword [ebp + 0x14]
push 0x104
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40caed
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0x18], 0
je 0x40cafd
push dword [ebp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push esi
mov ecx, 0x48feb8
call fcn.00429dbf
pop esi
pop edi
pop ebp
ret
Function at 0x40cb9a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x411
lea ecx, [ebp - 0xc]
mov byte [0x48fec5], 1
call fcn.0042aed6
push 0x822
push 0
push dword [ebp - 0xc]
call fcn.00466780
mov esi, dword [ebp - 0xc]
add esp, 0xc
push 0x104
mov dword [ebp - 0x10], esi
add esi, 0x410
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.PE_IDBASE
push 0x1000
mov edi, 0x48feb8
push edi
call fcn.0042ccbb
push str.WM_PE_BASE
push 0x5000
push edi
call fcn.0042ccbb
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x18
push esi
push 0x47bfc2
call edi
push esi
mov ebx, 0x48feb8
push str.MyName
mov ecx, ebx
call fcn.00429dbf
push 0x5c
push 0
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x40cc57
add eax, 2
push eax
push 0x47bfae
mov dword [ebp - 0x18], eax
call edi
push dword [ebp - 0x18]
mov ecx, ebx
push str.MyName0
call fcn.00429dbf
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push str.Desktop
call fcn.0040cb1c
mov dword [esp], str.Favorites
call fcn.0040cb1c
mov dword [esp], str.IECache
call fcn.0040cb1c
mov dword [esp], str.Programs
call fcn.0040cb1c
mov dword [esp], str.SendTo
call fcn.0040cb1c
mov dword [esp], str.Personal
call fcn.0040cb1c
lea ecx, [ebp - 0x14]
mov dword [esp], 0x47bf84
call fcn.00434695
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
mov ebx, 0x47b598
push ebx
mov edi, 0x80000001
push edi
mov dword [ebp - 8], 0x410
call fcn.00426db8
add esp, 0x18
test eax, eax
je 0x40ccff
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push str.Start_Menu
push ebx
push edi
call fcn.00426db8
add esp, 0x18
test eax, eax
jne 0x40cd15
push 0
push dword [ebp - 0x10]
push esi
push dword [ebp - 4]
push 0x47b6ac
call fcn.0040cac6
add esp, 0x14
push str.Startup
call fcn.0040cb1c
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push str.AppData
push ebx
push edi
mov dword [ebp - 8], 0x410
call fcn.00426db8
add esp, 0x1c
test eax, eax
jne 0x40cd5f
push str.MicrosoftInternet_ExplorerQuick_Launch
push dword [ebp - 0x10]
push esi
push dword [ebp - 4]
push str.QuickLaunch
call fcn.0040cac6
add esp, 0x14
lea ecx, [ebp - 0x14]
call fcn.0042602e
lea ecx, [ebp - 0xc]
call fcn.0042602e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d899
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 6
pop ecx
push dword [ebp + 8]
mov esi, str.format.com
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
call fcn.00467467
mov esi, dword [ebp + 0xc]
push esi
mov edi, eax
call fcn.00467467
add edi, eax
pop ecx
pop ecx
lea eax, [edi + edi + 0x1a]
add eax, 0x1e
push eax
lea ecx, [ebp - 4]
call fcn.0042add7
mov ebx, dword [ebp - 4]
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x70], 0x44
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
or dword [ebp - 0x44], 1
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push ebx
mov word [ebp - 0x40], di
call fcn.0046744b
push dword [ebp + 8]
push ebx
call fcn.00467421
push 0x47aff8
push ebx
call fcn.00467421
add esp, 0x18
cmp word [esi], 0x22
jne 0x40d935
inc esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jle 0x40d935
lea eax, [esi + eax*2 - 2]
cmp word [eax], 0x22
jne 0x40d935
mov word [eax], di
push esi
push ebx
call fcn.00467421
pop ecx
pop ecx
push 0x47c94c
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40d95b
push 0x47c940
push ebx
call fcn.00467421
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40d986
push str.Cannot_format_drive:
call fcn.0040d24e
pop ecx
push 8
pop edi
jmp 0x40d9a1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 4]
call fcn.0042602e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f57d
Capabilities:
Acquire debug privileges

Disassembly:
cmp byte [ecx], 0
je 0x40f597
and byte [0x4901c4], 0xfb
push 4
push str.SeDebugPrivilege
call fcn.0040cf93
pop ecx
pop ecx
ret

Function at 0x40f598
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, 0x49062c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.00402f13
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
pop ecx
push 0x5c
push dword [ebp + 8]
mov byte [ebp - 4], al
jmp 0x40f5f0
push dword [ebp + 8]
and word [esi], 0
call fcn.004662e5
test eax, eax
pop ecx
jne 0x40f5e5
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], 0x5c
push 0x5c
add esi, 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x40f5ca
cmp byte [ebp - 4], al
je 0x40f606
push dword [ebp - 8]
call fcn.00402f24
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x40f694
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x40f6bb
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0040a8f2
test eax, eax
je 0x40f6bb
call fcn.0040a979
test eax, eax
mov dword [esp + 0xc], eax
jne 0x40f6c2
xor eax, eax
jmp 0x40f784
mov ecx, dword [esi + 0x10]
mov ecx, dword [ecx + 0x34]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebp
push edi
push 0x40
mov ebp, 0x3000
push ebp
push eax
push ecx
call ebx
mov edi, eax
test edi, edi
jne 0x40f6fa
push 0x40
push ebp
push dword [esp + 0x20]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x40f6fa
xor eax, eax
jmp 0x40f781
push dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.0040a9e8
mov eax, dword [esi + 0x10]
xor ebx, ebx
cmp dword [eax + 0xa0], ebx
jbe 0x40f727
cmp dword [eax + 0xa4], ebx
jbe 0x40f727
push edi
mov ecx, esi
call fcn.0040a7b3
test eax, eax
je 0x40f6f3
push edi
mov ecx, esi
call fcn.0040a812
test eax, eax
jne 0x40f742
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40f6f3
mov eax, dword [esi + 0x10]
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
push ebx
xor ebp, ebp
inc ebp
push ebp
add eax, edi
push edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x40f77a
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], ebx
jmp 0x40f6f3
mov dword [esi], ebp
mov dword [esi + 8], edi
mov eax, ebp
pop edi
pop ebp
pop ebx
pop esi
ret 8

Function at 0x40f7ea
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00466780
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp + 8], 0
je 0x40f81f
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
leave
ret
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
leave
ret
Function at 0x40f8b6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x18]
test ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], 0x20
jne 0x40f8d0
lea ebx, [ebp - 0xc]
push dword [ebp + 0x10]
mov ax, word [ebx + 2]
push dword [ebp + 0xc]
mov word [ebp - 8], ax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40f8fb
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
jmp 0x40f8fd
xor edi, edi
test esi, esi
je 0x40f90d
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x40f90f
xor eax, eax
xor cl, cl
test byte [ebx], 1
mov byte [ebp + 0x1b], cl
je 0x40f92b
test eax, eax
je 0x40fa0e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov cl, byte [ebp + 0x1b]
mov esi, eax
test esi, esi
mov dword [ebp - 4], eax
je 0x40fa0e
test edi, edi
jle 0x40fa0e
test byte [ebx], 0x40
jne 0x40f99e
push 0
push edi
push esi
call fcn.004285d7
add esp, 0xc
test al, al
mov byte [ebp + 0x1b], al
je 0x40f99e
test byte [ebx], 0x20
je 0x40f968
test al, 2
je 0x40f968
xor eax, eax
jmp 0x40fa17
push 0
lea ecx, [ebp - 0x18]
call fcn.00434648
movzx eax, word [ebx + 2]
push eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.0042e2cf
and dword [ebp - 0x18], 0
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0042602e
jmp 0x40f9dd
mov esi, dword [ebp + 0x14]
lea eax, [edi + 0x410]
push eax
mov ecx, esi
call fcn.0042adfe
push edi
push dword [ebp - 4]
mov dword [esi + 8], edi
push dword [esi]
mov dword [esi + 4], edi
call fcn.004669c0
add esp, 0xc
cmp word [ebp - 8], 0
je 0x40f9dd
movzx eax, word [ebp - 8]
inc edi
shr edi, 1
push edi
push eax
push dword [esi]
call fcn.0040c36f
add esp, 0xc
mov eax, dword [esi + 4]
mov edi, dword [esi]
lea ecx, [eax + 0x10]
push 0x10
add eax, edi
push 0
push eax
mov dword [esi + 8], ecx
call fcn.00466780
movsx eax, word [ebx + 2]
push 0xc
push eax
mov eax, dword [esi + 4]
add eax, dword [esi]
push eax
call fcn.00466780
mov cl, byte [ebp + 0x1b]
add esp, 0x18
jmp 0x40fa10
xor edi, edi
and ecx, 2
or dword [ebx], ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fa1c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00403b3c
cmp dword [ebp - 8], ebx
jne 0x40fa4d
push 0xfffffffffffffffe
pop esi
jmp 0x40fb12
push edi
push dword [ebp - 8]
call fcn.0042a969
push ebx
push ebx
push ebx
push dword [ebp - 8]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.00426f04
add esp, 0x14
add esi, 0xc
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0042adfe
mov edi, dword [esi]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
push 6
add eax, edi
push ebx
push eax
call fcn.00466780
mov eax, dword [ebp - 0xc]
push dword [ebp + 0x10]
mov dword [esi + 8], eax
push eax
push edi
mov dword [esi + 4], eax
call fcn.004285d7
add esp, 0x18
cmp al, 1
mov byte [ebp - 1], al
pop edi
jne 0x40fafb
push dword [0x48feac]
lea ecx, [ebp - 0x1c]
push esi
call fcn.00409a50
mov eax, dword [ebp - 0xc]
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0042e2cf
add esp, 0xc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 6
push eax
mov ecx, esi
call fcn.0042adfe
lea ecx, [ebp - 0x1c]
call fcn.0042602e
push 1
push esi
call fcn.00433b9f
cmp byte [ebp - 1], bl
pop ecx
pop ecx
jge 0x40fb0f
or esi, 0xffffffff
jmp 0x40fb12
mov esi, dword [esi + 4]
lea ecx, [ebp - 8]
call fcn.004029f8
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x410e3c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
je 0x410ee9
mov ecx, dword [ebp + 8]
xor eax, eax
cmp word [ecx], 0x21
sete al
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x410e86
add dword [ebp + 8], 2
lea ecx, [ebp + 8]
call fcn.00409aad
push edi
push dword [ebp + 8]
call fcn.0040ca55
pop ecx
push 0x30
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x410ed6
cmp dword [ebp - 8], eax
je 0x410eba
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
inc ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x410eca
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test ebx, ebx
jne 0x410ecf
inc ebx
call esi
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
pop edi
je 0x410ee9
mov eax, dword [ebp - 4]
jmp 0x410eeb
call esi
pop esi
pop ebx
leave
ret