joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Start service

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
xor esi, esi
cmp ebx, 0xffffffff
jne 0x406d13
xor ebx, ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x406d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406ddb
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x2c]
push edi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x406d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406d75
push ebp
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push ebp
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test ebx, ebx
jne 0x406da8
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x406dca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406dc7
mov esi, eax
jmp 0x406dca
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x406dca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406dc7
mov esi, eax
jmp 0x406dca
or esi, 0xffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x406df0
Capabilities:
Query service status

Disassembly:
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x406e17
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406e8c
pop esi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0xc]
push ebp
push edi
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x406e56
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406e49
push ebx
mov esi, eax
call ebp
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
ret
push ebx
or esi, 0xffffffff
call ebp
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406e82
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x406e7f
push edi
mov esi, eax
call ebp
push ebx
call ebp
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
ret
or esi, 0xffffffff
push edi
call ebp
push ebx
call ebp
pop edi
mov eax, esi
pop ebp
pop esi
pop ebx
ret
Function at 0x406e90
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x10c
mov al, byte [0x41f4b4]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x114]
lea edx, [esp + 0xc]
stosw word es:[edi], ax
push ecx
push str.SYSTEMCurrentControlSetServices_s
push 0x103
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 2
stosb byte es:[edi], al
call fcn.0040b100
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push eax
push ecx
push 0
push 2
push 0
push 0
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
pop edi
jne 0x406f46
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x118]
push esi
push eax
mov eax, dword [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x4070e0
Capabilities:
Start service

Disassembly:
push ebx
push edi
xor edi, edi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x407107
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40717b
pop edi
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0xc]
push ebp
push esi
push 0x14
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x407146
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x407139
push ebx
mov edi, eax
call ebp
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
ret
push ebx
or edi, 0xffffffff
call ebp
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
ret
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x407171
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40716e
push esi
mov edi, eax
call ebp
push ebx
call ebp
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
ret
or edi, 0xffffffff
push esi
call ebp
push ebx
call ebp
pop esi
mov eax, edi
pop ebp
pop edi
pop ebx
ret
Function at 0x409190
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x120]
push eax
lea ecx, [esp + 0x14]
push str.SYSTEMCurrentControlSetControlClass_s
push ecx
mov dword [esp + 0x14], ebx
call fcn.00409e89
add esp, 0xc
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409222
push esi
mov esi, dword [esp + 0x120]
lea ecx, [esp + 0xc]
push edi
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.NetCfgInstanceId
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x409213
mov eax, dword [esp + 0x10]
cmp eax, ebx
jae 0x409213
mov byte [eax + esi], 0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x110
ret

Function at 0x4096b0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x1114
call fcn.0040b250
movsx eax, byte [esp + 0x1118]
push esi
push eax
lea ecx, [esp + 0x18]
push str.._c:
push ecx
call fcn.00409e89
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409701
or eax, eax
pop esi
add esp, 0x1114
ret
xor eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 4], eax
lea edx, [esp + 0x118]
mov dword [esp + 8], eax
push eax
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push 0x1000
push edx
lea eax, [esp + 0x14]
push 0xc
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push esi
jne 0x409753
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
add esp, 0x1114
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x134]
pop esi
add esp, 0x1114
ret

Function at 0x409770
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, dword [esp + 8]
lea eax, [esp + 8]
mov byte [esp + 8], bl
push eax
mov byte [esp + 0xd], 0x3a
mov byte [esp + 0xe], 0x5c
mov byte [esp + 0xf], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.default.0x409798
jmp dword [eax*4 + 0x4097f0]
xor eax, eax
pop ebx
ret
mov eax, 1
pop ebx
ret
mov eax, 2
pop ebx
ret
push ebx
call fcn.004096b0
sub eax, 7
add esp, 4
neg eax
sbb eax, eax
pop ebx
add eax, 4
ret
mov eax, 5
pop ebx
ret
push ebx
call fcn.004096b0
sub eax, 7
add esp, 4
neg eax
sbb eax, eax
pop ebx
add eax, 7
ret
mov eax, 8
pop ebx
ret
mov eax, 9
pop ebx
ret
Function at 0x409810
Capabilities:
Get disk information

Disassembly:
sub esp, 0x100
mov ecx, 0x40
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, dword [esp + 0x10c]
xor esi, esi
lea ecx, [esp + 0xa]
mov dl, byte [ecx - 1]
mov al, byte [ecx]
test dl, dl
jne 0x40984f
test al, al
je 0x40985b
mov dl, byte [ecx - 2]
mov byte [esi + edi], dl
inc esi
add ecx, 4
jmp 0x409842
mov eax, esi
pop edi
pop esi
add esp, 0x100
ret

Function at 0x409870
Capabilities:
Get disk information via ioctl

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x46c
cmp eax, 2
push ebx
push ebp
push esi
push edi
jb 0x409a0d
cmp eax, 3
jbe 0x40989f
cmp eax, 5
jne 0x409a0d
mov dword [esp + 0x10], 0x4170a0
jmp 0x4098a7
mov dword [esp + 0x10], 0x4170b0
mov eax, dword [esp + 0x10]
push 0x12
push 0
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409a0d
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov dword [esp + 0x60], eax
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
lea ecx, [esp + 0x60]
push ecx
push ebp
push edx
push 0
push esi
call edi
test eax, eax
je 0x409a06
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
push 0
push esi
call edi
lea edx, [esp + 0x14]
push 0
push edx
push 0
lea eax, [esp + 0x50]
push 0
push eax
push esi
mov dword [esp + 0x2c], 0
call ebx
mov edx, dword [esp + 0x14]
test edx, edx
je 0x4099e3
cmp edx, 0x400
ja 0x4099e3
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x7c], 5
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x14]
push ecx
push eax
push edx
lea ecx, [esp + 0x88]
lea edx, [esp + 0x50]
push ecx
push edx
push esi
mov dword [esp + 0x40], 0x1c
call ebx
test eax, eax
je 0x4099e3
push 0
push 0
push 3
push 0
push 3
lea eax, [esp + 0x94]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4099e3
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push 0
push 0
push 0x2d1080
push edi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4099dc
mov eax, dword [esp + 0x480]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
je 0x4099e9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
jmp 0x4098e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret
Function at 0x409b00
Capabilities:
Get common file path
Get disk information
Get disk information via ioctl

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00409810
add esp, 4
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x18], eax
push 0xff
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x409b3d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
movsx edx, byte [esp + 0x1b0]
push edx
lea eax, [esp + 0xb4]
push str.._c:
push eax
call fcn.00409e89
add esp, 0xc
lea ecx, [esp + 0xb0]
push 0
push 0x80
push 3
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x409b89
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x28]
push 0
push edx
lea eax, [esp + 0x24]
push 0xc
push eax
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push esi
jne 0x409bbf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x4c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x48], ecx
mov edi, 1
jle 0x409ce8
lea edx, [esp + 0x4c]
mov dword [esp + 0x10], edx
mov al, byte [esp + ebx + 0x2c]
push eax
call fcn.00409770
add esp, 4
cmp eax, 3
jne 0x409cdb
movsx ecx, byte [esp + ebx + 0x2c]
push ecx
lea edx, [esp + 0xb4]
push str.._c:
push edx
call fcn.00409e89
add esp, 0xc
lea eax, [esp + 0xb0]
push 0
push 0x80
push 3
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x409cfa
lea ecx, [esp + 0x28]
push 0
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push esi
je 0x409cf8
call ebp
xor edx, edx
test edi, edi
jle 0x409c9b
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x48]
mov ecx, edi
cmp dword [eax], esi
jne 0x409c91
mov edx, 1
add eax, 4
dec ecx
jne 0x409c88
test edx, edx
jne 0x409cdb
mov eax, dword [0x41b390]
mov cl, byte [esp + ebx + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
push edx
mov byte [esp + 0x18], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push eax
mov eax, dword [esp + 0x24]
push eax
call fcn.00409a20
add esp, 8
test eax, eax
je 0x409cfa
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
inc edi
mov dword [eax], ecx
add eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x409bf7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
Function at 0x40ccb3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ccd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b1c8
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40ccf6
test byte [esp + 8], 2
je 0x40ccf6
call fcn.0040b23b
mov dword [eax], 0xd
call fcn.0040b244
mov dword [eax], 5
jmp 0x40cccf
xor eax, eax
ret

Function at 0x412b70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
test eax, eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
je 0x412c59
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x412c59
mov dword [eax], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x412bcc
cmp byte [eax], 0
je 0x412bcc
lea ecx, [esp + 8]
push ecx
push 1
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412c5e
mov ebx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebp
push esi
push edi
push edx
call fcn.0040b745
mov esi, eax
add esp, 4
test esi, esi
je 0x412c25
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push esi
push ebp
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x412c2c
push esi
call fcn.0040b27f
add esp, 4
cmp edi, 0xea
jne 0x412c40
mov edx, dword [esp + 0x10]
push edx
call fcn.0040b745
mov esi, eax
add esp, 4
test esi, esi
jne 0x412be6
mov edi, 0x5aa
jmp 0x412c40
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x30]
test eax, eax
je 0x412c40
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x412c4f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, 0x57
pop ebx
add esp, 8
ret

Function at 0x412da0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x104
mov al, byte [0x41f4b4]
push esi
push edi
mov byte [esp + 8], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x110]
test edi, edi
jne 0x412dd7
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
mov esi, dword [esp + 0x114]
test esi, esi
jne 0x412de7
mov esi, 0x41f4b4
lea ecx, [esp + 8]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x412e04
pop edi
pop esi
add esp, 0x104
ret
push edi
push 0
lea edx, [esp + 0x10]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x412e20
pop edi
pop esi
add esp, 0x104
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
Function at 0x412e40
Capabilities:
Delete file
Delete registry key

Disassembly:
sub esp, 0x110
mov al, byte [0x41f4b4]
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov esi, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x124]
mov dword [esp + 0xc], 0
test edi, edi
mov dword [esp + 8], 0
jne 0x412e85
mov edi, esi
lea ecx, [esp + 0x14]
push str.RegBk
push ecx
call fcn.00412da0
add esp, 8
test eax, eax
jne 0x412eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412faa
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
mov eax, dword [esp + 0x120]
lea edx, [esp + 0xc]
push edx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x412faa
push ebx
push str.SeBackupPrivilege
call fcn.00406460
add esp, 4
test eax, eax
je 0x412f73
push str.SeRestorePrivilege
call fcn.00406460
add esp, 4
test eax, eax
je 0x412f73
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
mov esi, eax
test esi, esi
jne 0x412f84
mov ebx, dword [esp + 0x12c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x412f84
cmp dword [esp + 0x14], 1
je 0x412f51
mov eax, dword [esp + 0x130]
test eax, eax
jne 0x412f51
mov esi, 0xb7
jmp 0x412f84
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 8
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyA]
mov esi, eax
test esi, esi
je 0x412f84
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x412f84
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x412f81
mov esi, eax
jmp 0x412f84
or esi, 0xffffffff
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov eax, dword [esp + 0xc]
pop ebx
test eax, eax
je 0x412fa8
push eax
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x110
ret
Function at 0x413200
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], eax
push esi
push eax
push eax
push 3
push eax
push 3
push eax
push ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413237
xor eax, eax
pop esi
add esp, 0xc
ret
push edi
lea edx, [esp + 0x18]
push 0
push edx
lea eax, [esp + 0x10]
push 0xc
push eax
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test edi, edi
je 0x413286
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41326a
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x413278
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x413286
mov ecx, dword [esp + 8]
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret

Function at 0x414880
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [ecx + 0x18]
mov dword [eax], 0x67452301
mov edx, dword [ecx + 0x18]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ecx + 0x18]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ecx + 0x18]
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x23e16d8c
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x1ace3ec8
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40edb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp ebx, 0x3b
push edi
jne 0x40edcb
mov ebx, dword [0x44b75c]
mov eax, dword [0x44b760]
jmp 0x40edf5
cmp ebx, 0x2c
jne 0x40ede0
mov ebx, dword [0x44b75c]
mov eax, dword [0x44b760]
xor ebx, 0x20
jmp 0x40edf5
push 1
call fcn.0040e030
add esp, 4
mov dword [0x44b760], eax
mov dword [0x44b75c], ebx
test eax, eax
je 0x40ee69
mov cl, byte [ebx*2 + str._________]
mov edx, dword [0x44c7c0]
and cl, 1
mov esi, dword [0x44b748]
neg cl
sbb ecx, ecx
and ecx, 2
dec ecx
mov edi, ecx
add edx, edi
cmp edx, esi
jb 0x40ee69
mov cl, byte [edx]
test cl, cl
je 0x40ee35
and ecx, 0xff
cmp ecx, eax
je 0x40ee35
add edx, edi
cmp edx, esi
jae 0x40ee1f
cmp edx, esi
jb 0x40ee69
cmp byte [edx], 0
je 0x40ee69
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebp + 0xc], ecx
jne 0x40ee19
cmp ebx, 0x54
je 0x40ee51
cmp ebx, 0x74
jne 0x40ee53
sub edx, edi
sub edx, dword [0x44c7c0]
push edx
call fcn.00410ae0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0040ef70
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40ef90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov cl, byte [esi*2 + str._________]
and ecx, 2
je 0x40efa8
xor esi, 0x20
mov eax, dword [0x44c7c0]
cmp esi, 0x62
mov bl, 0x10
jne 0x40f0a5
mov esi, dword [0x44b748]
cmp eax, esi
jbe 0x40efd5
xor edx, edx
mov dl, byte [eax - 1]
test byte [edx*2 + str._________], bl
je 0x40efd5
dec eax
cmp eax, esi
ja 0x40efc2
test ecx, ecx
je 0x40f00e
cmp eax, esi
jbe 0x40f08f
xor ecx, ecx
mov cl, byte [eax - 1]
test byte [ecx*2 + str._________], bl
jne 0x40f08f
dec eax
cmp eax, esi
ja 0x40efe1
mov ecx, dword [0x44c7c0]
sub ecx, eax
push ecx
call fcn.00410c10
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, esi
mov edi, 0x804
jbe 0x40f08f
mov cl, byte [eax - 1]
mov edx, ecx
and edx, 0xff
test word [edx*2 + str._________], di
jne 0x40f031
cmp cl, 0x5f
jne 0x40f066
mov cl, byte [eax - 1]
mov edx, ecx
and edx, 0xff
test word [edx*2 + str._________], di
jne 0x40f04b
cmp cl, 0x5f
jne 0x40f08f
dec eax
cmp eax, esi
ja 0x40f031
mov ecx, dword [0x44c7c0]
sub ecx, eax
push ecx
call fcn.00410c10
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, esi
jbe 0x40f08f
mov cl, byte [eax - 1]
mov edx, ecx
and edx, 0xff
mov dx, word [edx*2 + str._________]
test edi, edx
jne 0x40f08f
cmp cl, 0x5f
je 0x40f08f
test bl, dl
jne 0x40f08f
dec eax
cmp eax, esi
ja 0x40f06a
mov ecx, dword [0x44c7c0]
sub ecx, eax
push ecx
call fcn.00410c10
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
cmp esi, 0x65
jne 0x40f0cb
cmp byte [eax], 0
je 0x40f11b
inc eax
xor edx, edx
mov dl, byte [eax]
test byte [edx*2 + str._________], bl
je 0x40f0cb
inc eax
xor edx, edx
mov dl, byte [eax]
test byte [edx*2 + str._________], bl
jne 0x40f0bd
test ecx, ecx
mov cl, byte [eax]
je 0x40f120
test cl, cl
je 0x40f0ec
and ecx, 0xff
test byte [ecx*2 + str._________], bl
jne 0x40f0ec
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40f0d5
cmp esi, 0x77
jne 0x40f10c
xor ecx, ecx
mov cl, byte [eax]
test byte [ecx*2 + str._________], bl
je 0x40f10c
inc eax
xor edx, edx
mov dl, byte [eax]
test byte [edx*2 + str._________], bl
jne 0x40f0fe
sub eax, dword [0x44c7c0]
push eax
call fcn.00410b50
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, ecx
mov edi, 0x804
and edx, 0xff
test word [edx*2 + str._________], di
jne 0x40f167
cmp cl, 0x5f
je 0x40f167
test cl, cl
je 0x40f0ec
mov edx, ecx
and edx, 0xff
mov dx, word [edx*2 + str._________]
test edi, edx
jne 0x40f0ec
cmp cl, 0x5f
je 0x40f0ec
test bl, dl
jne 0x40f0ec
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40f140
jmp 0x40f0ec
mov cl, byte [eax]
mov edx, ecx
and edx, 0xff
test word [edx*2 + str._________], di
jne 0x40f184
cmp cl, 0x5f
jne 0x40f0ec
inc eax
jmp 0x40f167