joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
xor esi, esi
mov dword [esp + 4], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 4
mov dword [esp + 8], esi
cmp eax, esi
je 0x41a60c
lea ecx, [esp + 8]
push ecx
push 1
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41a642
mov eax, dword [esp + 8]
jmp 0x41a611
mov eax, SysReAllocString
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push 0x44a174
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a63e
cmp dword [esp + 0xc], 4
jne 0x41a63e
cmp dword [esp + 0x10], esi
jne 0x41a642
mov dword [esp + 4], esi
mov eax, dword [esp + 8]
cmp eax, esi
pop esi
je 0x41a652
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0x10
ret

Function at 0x41d500
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43e72a
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x808], eax
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x82c]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
mov esi, 1
mov dword [esp + 0x824], esi
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esp + 0x830]
cmp dword [eax - 4], esi
jle 0x41d58d
mov ecx, dword [eax - 0xc]
push ecx
lea edx, [esp + 0x834]
push edx
call fcn.0041b300
mov eax, dword [esp + 0x830]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d590
lea edi, [esp + 0x18]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x41d5a4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
lea ecx, [esp + 0x1c]
call fcn.00403880
mov dword [esp + 0x10], 1
mov byte [esp + 0x824], 0
lea ecx, [esp + 0x830]
call fcn.0040c820
mov eax, ebp
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004042c0
add esp, 0x818
ret
Function at 0x41d610
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x43bd48
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0xf], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x41d658
push eax
call edi
mov dword [esp + 0x10], ebx
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x44a178
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41d6bb
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41d680
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea ecx, [eax + eax]
push ecx
push esi
push 1
push 0x44a338
push ebx
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
jne 0x41d6bb
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov byte [esp + 0xf], 1
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x41d6ce
push eax
call edi
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x41dea0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43eb79
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
push 0x23
mov dword [esp + 0x14], 0
call fcn.004203a0
add esp, 4
mov dword [esp + 0x1c], 0
push 0xd
push 0x448b60
push edi
mov dword [esp + 0x1c], 1
call fcn.00421670
mov eax, dword [edi]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41df22
mov eax, dword [edi]
push 0
push eax
call esi
mov ecx, dword [edi]
call fcn.00401120
push 3
push 0x449b2c
push edi
call fcn.00421670
mov eax, dword [edi]
push eax
call ebp
test eax, eax
jne 0x41df46
mov eax, dword [edi]
push 0
push eax
call esi
mov ecx, dword [edi]
call fcn.00401120
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x41f0f0
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x43be70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], 0
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x41f19f
mov eax, dword [esp + 0x28]
push 0x10
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x20], 1
test esi, esi
je 0x41f193
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x41f193
mov byte [esp + 0x20], 0
push esi
mov esi, ebp
call esi
mov dword [esp + 0x20], 0xffffffff
push edi
call esi
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov byte [esp + 0x20], 0
test esi, esi
je 0x41f19f
push esi
call ebp
mov dword [esp + 0x20], 0xffffffff
test edi, edi
je 0x41f1ae
push edi
call ebp
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x41fa00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43e419
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x50], esi
mov eax, dword [esp + 0x58]
mov edi, ecx
push eax
xor ecx, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
call fcn.00403880
mov dword [esp + 0x50], esi
mov dword [esp + 0x3c], esi
xor eax, eax
push esi
mov ebx, 0x400
lea esi, [esp + 0x2c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
call fcn.00413360
mov dword [esp + 0x50], 1
mov ecx, dword [esp + 0x3c]
xor ebx, ebx
lea edx, [ecx + ecx - 2]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x50], 2
cmp edi, ebx
je 0x41fad8
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41fab6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x14]
push eax
push 1
push ebx
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41fbb7
mov ecx, dword [esp + 0x14]
jmp 0x41fadd
mov ecx, SysReAllocString
mov eax, dword [esp + 0x2c]
mov esi, 8
cmp dword [esp + 0x40], esi
jae 0x41faf0
lea eax, [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push 0x44a338
push ecx
call ebp
cmp eax, 0xea
jne 0x41fb72
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
shr ebx, 1
inc ebx
cmp ebx, ecx
ja 0x41fb33
or eax, 0xffffffff
lea esi, [esp + 0x28]
call fcn.004070a0
mov esi, 8
jmp 0x41fb40
mov eax, ebx
sub eax, ecx
lea ebx, [esp + 0x28]
call fcn.00415900
mov ecx, dword [esp + 0x14]
test edi, edi
jne 0x41fb4d
mov ecx, SysReAllocString
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x41fb5b
lea eax, [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x44a338
push ecx
call ebp
xor ebx, ebx
cmp eax, ebx
jne 0x41fba9
cmp dword [esp + 0x1c], 1
jne 0x41fba9
mov eax, dword [esp + 0x18]
cmp eax, ebx
jbe 0x41fba9
shr eax, 1
lea ecx, [esp + 0x28]
call fcn.0040a2a0
mov edx, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x41fb9e
lea edx, [esp + 0x2c]
mov edi, dword [esp + 0x20]
call fcn.00410040
jmp 0x41fbbc
mov eax, dword [esp + 0x20]
push ebx
xor ebx, ebx
call fcn.00423870
jmp 0x41fbbc
mov esi, 8
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41fbd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x50], bl
cmp dword [esp + 0x40], esi
jb 0x41fbe7
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004042ed
add esp, 4
xor edx, edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004042c0
add esp, 0x40
ret
Function at 0x4203a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43e671
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor ecx, ecx
push eax
mov ebx, 0x104
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], cx
call fcn.00413360
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x1c]
mov ebp, 8
cmp dword [esp + 0x30], ebp
jae 0x420418
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x48]
push 1
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42043c
or eax, 0xffffffff
xor ebx, ebx
lea esi, [esp + 0x18]
call fcn.004070a0
jmp 0x420484
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x42044a
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420450
mov ecx, dword [esp + 0x2c]
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, ecx
ja 0x420477
or eax, 0xffffffff
lea esi, [esp + 0x18]
call fcn.004070a0
jmp 0x420484
mov eax, ebx
sub eax, ecx
lea ebx, [esp + 0x18]
call fcn.00415900
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x420492
lea ecx, [esp + 0x1c]
push edi
call fcn.00403880
xor ebx, ebx
mov dword [esp + 0x10], 1
mov byte [esp + 0x40], bl
cmp dword [esp + 0x30], ebp
jb 0x4204b9
mov eax, dword [esp + 0x1c]
push eax
call fcn.004042ed
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004042c0
add esp, 0x34
ret
Function at 0x420a80
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x43c570
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea eax, [esp + 4]
push eax
push 0x448404
push 1
push 0
push 0x448414
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x420b67
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x420b14
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0x44]
push ecx
call eax
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x420b2b
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
push ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x448424
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x420b67
mov eax, dword [esp + 8]
test eax, eax
je 0x420b67
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x14], 2
lea ecx, [esp + 0x1c]
call fcn.0040c820
mov byte [esp + 0x14], 1
lea ecx, [esp + 0x20]
call fcn.0040c820
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x24]
call fcn.0040c820
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.0040c820
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret
Function at 0x421090
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x43efe0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0
mov ecx, 0x45a408
mov dword [esp + 0x1c], 0x45a408
call fcn.00423fab
mov dword [esp + 0x24], 0
push 0x4182b0
mov dword [0x45a408], 0x44a584
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00407fc0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.00403880
mov byte [esp + 0x24], 1
push 0x67
lea edx, [esp + 0x14]
push edx
call fcn.0040cab0
mov byte [esp + 0x24], 2
mov eax, dword [eax]
test eax, eax
jne 0x42111e
or eax, 0xffffffff
jmp 0x421146
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 0xc], 0
jge 0x42112d
or eax, 0xffffffff
jmp 0x421146
push eax
push ecx
call fcn.0042a5b3
add esp, 8
test eax, eax
jne 0x421140
or eax, 0xffffffff
jmp 0x421146
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
setne bl
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040c820
test bl, bl
je 0x421165
mov byte [0x45a376], 1
push 0x69
lea eax, [esp + 0x14]
push eax
call fcn.0040cab0
mov byte [esp + 0x24], 3
mov eax, dword [eax]
test eax, eax
jne 0x421181
or eax, 0xffffffff
jmp 0x4211a9
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 0xc], 0
jge 0x421190
or eax, 0xffffffff
jmp 0x4211a9
push eax
push ecx
call fcn.0042a5b3
add esp, 8
test eax, eax
jne 0x4211a3
or eax, 0xffffffff
jmp 0x4211a9
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
setne bl
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040c820
test bl, bl
je 0x4211c8
mov byte [0x45a377], 1
cmp byte [0x45a376], 0
je 0x421296
call fcn.00402330
test al, al
je 0x4211e8
push 1
call fcn.0040d1a0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call fcn.00409e70
add esp, 4
mov bl, 4
mov byte [esp + 0x24], bl
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
je 0x42120a
call fcn.0041d610
push 0x6a
lea edx, [esp + 0x18]
push edx
call fcn.0040cab0
mov byte [esp + 0x24], 5
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040c820
push 0x6b
lea eax, [esp + 0x18]
push eax
call fcn.0040cab0
mov byte [esp + 0x24], 6
mov eax, dword [eax]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040c820
push 0x6c
lea ecx, [esp + 0x18]
push ecx
call fcn.0040cab0
mov byte [esp + 0x24], 7
mov eax, dword [eax]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040c820
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040c820
mov eax, 0x409
mov dword [0x457354], eax
mov dword [0x457358], eax
mov byte [esp + 0x24], 0
lea ecx, [esp + 0xc]
call fcn.0040c820
mov dword [esp + 0x24], 0xffffffff
mov eax, 0x45a408
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x421f80
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d441
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x24c
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.0042ace0
lea ecx, [esp + 0x20]
push esi
push ecx
mov ebx, str..
call fcn.00412b80
add esp, 0x14
mov dword [esp + 0x280], 0
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0040c820
cmp edi, 0xffffffff
je 0x42214e
mov ecx, 0x448b50
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422056
test dx, dx
je 0x422052
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422056
add eax, 4
add ecx, 4
test dx, dx
jne 0x422030
xor eax, eax
jmp 0x42205b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x422133
mov ecx, 0x448b54
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422096
test dx, dx
je 0x422092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422096
add eax, 4
add ecx, 4
test dx, dx
jne 0x422070
xor eax, eax
jmp 0x42209b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x422133
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, 0x448b5c
call fcn.00412b80
mov dword [esp + 0x288], 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ebx, [esp + 0x58]
call fcn.00412b80
add esp, 0x10
mov byte [esp + 0x280], 3
lea ecx, [esp + 0x18]
call fcn.0040c820
test byte [esp + 0x1c], 0x10
je 0x422104
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00421f80
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040c820
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x422027
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0xc], 0
je 0x42215d
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.004042c0
mov esp, ebp
pop ebp
ret
Function at 0x4223c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d598
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041b479
mov ebx, dword [eax + 0xc]
mov ebp, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 0
push 0
push 0
push 0xbb8
push ebx
call ebp
push 0
push 0
push 0
push 0
push 0x81
push ebx
mov edi, eax
call ebp
xor ebp, ebp
mov ebx, eax
mov dword [esp + 0x18], vtable.CGdiObject.0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], vtable.CBitmap.0
mov dword [esp + 0x50], 1
push edi
lea ecx, [esp + 0x1c]
call fcn.004012f5
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x20]
push 0x202
push ecx
push edx
push ebp
push ebp
push ebp
mov ecx, esi
call fcn.00403269
lea ecx, [esp + 0x18]
call fcn.0041cabe
push ebx
call fcn.00410710
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x50], eax
mov dword [esp + 0x18], vtable.CBitmap.0
mov dword [esp + 0x50], eax
lea ecx, [esp + 0x18]
call fcn.00404e50
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret

Function at 0x4226a0
Capabilities:
Create service
Modify service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x4226fa
mov ecx, dword [esp + 8]
push 0
push 0
push 0x449bfc
push 0
push str.UIGroup
push ecx
push 1
push 3
push 0x10
push 0xf01ff
push str.asrrealtimesrv
push str.asrrealtimesrv
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea edx, [esp]
push edx
push 7
push eax
mov dword [esp + 0xc], 0x493e0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
pop ecx
ret

Function at 0x422730
Capabilities:
Capture screenshot

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x84]
xor edx, edx
div ecx
mov ecx, eax
mov dword [esp], eax
test edx, edx
je 0x422750
inc ecx
mov dword [esp], ecx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [edi + 0x88]
xor edx, edx
div esi
mov ebp, eax
test edx, edx
je 0x42276c
inc ebp
xor ebx, ebx
test ecx, ecx
jle 0x4227bd
xor esi, esi
test ebp, ebp
jle 0x4227b8
jmp 0x422780
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x88]
mov ecx, dword [edi + 0x84]
push 0xcc0020
push 0
push 0
push edx
push eax
imul eax, esi
push ecx
imul ecx, ebx
push eax
mov eax, dword [esp + 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc esi
cmp esi, ebp
jl 0x422780
mov ecx, dword [esp + 0xc]
inc ebx
cmp ebx, ecx
jl 0x422772
pop esi
pop ebp
pop ebx
pop ecx
ret 0x18
Function at 0x4228e0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x34]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x42290d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
xor edx, edx
pop esi
add esp, 0x28
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x422932
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
xor eax, eax
xor edx, edx
pop esi
add esp, 0x28
ret
lea ecx, [esp + 8]
push ecx
push 0x24
lea edx, [esp + 0x14]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x422903
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call ebx
cmp dword [esp + 0x18], 2
mov ebp, dword [esp + 0x28]
mov edi, eax
jne 0x4229cb
mov eax, 0xcccccccd
mul dword [esp + 0x2c]
shr edx, 3
cmp edx, 0x3e8
jae 0x42297d
mov edx, 0x3e8
jmp 0x42298a
cmp edx, 0x2710
jbe 0x42298a
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4229cb
cmp dword [esp + 0x28], ebp
jbe 0x4229ba
call ebx
mov ebp, dword [esp + 0x28]
mov edi, eax
jmp 0x4229c4
call ebx
sub eax, edi
cmp eax, dword [esp + 0x2c]
ja 0x4229cb
cmp dword [esp + 0x18], 2
je 0x422962
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x3c]
push edx
call esi
pop ebp
pop ebx
pop edi
mov eax, 0x3e8
xor edx, edx
pop esi
add esp, 0x28
ret
Function at 0x424290
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43eab9
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
push 0x23
mov dword [esp + 0xc], 0
call fcn.004203a0
add esp, 4
mov dword [esp + 0x14], 0
push 0xd
push 0x448b60
push edi
mov dword [esp + 0x14], 1
call fcn.00421670
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x424303
mov ecx, dword [edi]
call fcn.00401120
push 7
push str._s3.txt
push edi
call fcn.00421670
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret