joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401240
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40126f
push str.InstallService_OpenSCManager_failed.
call fcn.00403140
add esp, 4
xor eax, eax
jmp 0x4013c8
cmp dword [ebp + 0xc], 0
je 0x4012a4
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 1
push 1
push 0x10
push str.phusb_Driver
push str.phusb_Driver
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
jmp 0x4012d4
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 2
push 0x10
push 0xf01ff
push 0x404340
push 0x404340
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401349
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x431
jne 0x40132e
push str.CreateService_failed_Service_exits.
call fcn.00403140
add esp, 4
push 0x10
push 0x404340
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40132c
push str.OpenService_failed_
call fcn.00403140
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4013c8
jmp 0x401349
push str.CreateService_failed_
call fcn.00403140
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4013c8
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4013a2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x420
jne 0x401395
push str.StartService_fail__because_service_already_Running__
call fcn.00403140
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x4013c8
push str.StartService_fail.
call fcn.00403140
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.InstallService_Driver_Success
call fcn.00403140
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401800
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00401770
test eax, eax
jne 0x401816
xor eax, eax
jmp 0x4018c9
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401842
push str.Couldnt_open_service_manager
call fcn.00403140
add esp, 4
xor eax, eax
jmp 0x4018c9
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401879
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Couldnt_open_service
call fcn.00403140
add esp, 4
xor eax, eax
jmp 0x4018c9
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4018b0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Couldnt_Start_service.
call fcn.00403140
add esp, 4
xor eax, eax
jmp 0x4018c9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4018d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
push eax
push str.InvokeExplorer:_s
call fcn.00403140
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryA]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x210]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
push 0x4043fc
lea edx, [ebp - 0x210]
push edx
call sub.msvcrt.dll_strcat
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.00401110
add esp, 4
test eax, eax
jne 0x401957
call fcn.00401180
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401110
add esp, 4
lea edx, [ebp - 0x210]
push edx
call fcn.00402b20
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x401996
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x401996
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x401974
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4019a0
Capabilities:
Delete file
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.phin.tmp
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x404420
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0x80
push 2
push 0
push 2
push 0x10000000
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Delete file
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x404420
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x401b3d
mov dword [ebp - 0x11c], 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
push ecx
call fcn.00402840
add esp, 4
mov dword [ebp - 0x114], eax
push 0
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x118]
mov byte [eax], 0
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401fd0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov dword [ebp - 0x858], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x85c], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x85c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402021
xor eax, eax
jmp 0x4021f3
mov dword [ebp - 0x81c], 0x800
lea edx, [ebp - 0x81c]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0
push str.netsvcs
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
cmp dword [ebp - 8], 0
je 0x40206e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x81d], 0
mov edx, dword [ebp - 0xc]
push edx
push str.netsvcs_0x_d
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x818], ecx
jmp 0x4020bd
push 0
mov edx, dword [ebp - 0x818]
push edx
call sub.msvcrt.dll_strchr
add esp, 8
add eax, 1
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4020ed
lea edx, [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x4020eb
mov byte [ebp - 0x81d], 1
jmp 0x4020ed
jmp 0x4020a3
movzx ecx, byte [ebp - 0x81d]
test ecx, ecx
jne 0x4020fa
jmp 0x402117
mov byte [ebp - 0x81d], 0
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, 1
test eax, eax
jne 0x40207c
lea ecx, [ebp - 0x854]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov byte [ebp + eax - 0x853], 0
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 2
push eax
lea eax, [ebp - 0x854]
push eax
mov ecx, dword [ebp - 0x81c]
lea edx, [ebp + ecx - 0x811]
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [ebp - 0x81c]
lea edx, [ecx + eax + 1]
push edx
lea eax, [ebp - 0x810]
push eax
push 7
push 0
push str.netsvcs
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
movzx ecx, byte [ebp - 0x81d]
test ecx, ecx
jne 0x4021ed
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 1
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x858], eax
lea ecx, [ebp - 0x854]
push ecx
mov edx, dword [ebp - 0x858]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, dword [ebp - 0x858]
mov esp, ebp
pop ebp
ret
Function at 0x402960
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4029f6
mov edx, dword [ebp + 8]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4029d2
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x120]
jmp 0x4029f9
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x12c]
push ecx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x402999
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x402a00
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0
je 0x402a12
cmp dword [ebp + 0xc], 0
jne 0x402a19
xor eax, eax
jmp 0x402ad9
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x402a45
xor eax, eax
jmp 0x402ad9
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402a6e
xor eax, eax
jmp 0x402ad9
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x402a91
xor eax, eax
jmp 0x402ad9
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x402ab4
xor eax, eax
jmp 0x402ad9
cmp dword [ebp - 0x24], 0
je 0x402ac4
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x402ad4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402b20
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
mov dword [ebp - 0x58], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 0x101
mov word [ebp - 0x28], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x402b99
mov ecx, dword [ebp + 8]
push ecx
push str.invoke_program__s_failed.
call fcn.00403140
add esp, 8
xor eax, eax
jmp 0x402bc1
push 0x3e8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4033d0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4033f8
xor eax, eax
jmp 0x4034d4
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403427
xor eax, eax
jmp 0x4034d4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4034b7
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 8]
je 0x4034a6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push 0x404a3c
call fcn.00403140
add esp, 4
xor eax, eax
jmp 0x4034d4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
jmp 0x4034d4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp + 0x10]
push eax
push 0x404a28
call fcn.00403140
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4035cd
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x404a58
call fcn.004038a4
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x403620
mov eax, dword [0x40003c]
lea eax, [eax + 0x400000]
cmp dword [eax], 0x4550
jne 0x403620
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x403638
cmp ecx, 0x20b
je 0x403625
mov dword [ebp - 0x1c], ebx
jmp 0x40364c
cmp dword [eax + 0x84], 0xe
jbe 0x403620
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x403646
cmp dword [eax + 0x74], 0xe
jbe 0x403620
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x406790], edi
mov dword [0x406794], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x40678c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x406788]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x406798], eax
call fcn.0040389e
cmp dword [0x406020], ebx
jne 0x4036a9
push fcn.0040389e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040388c
push 0x4041f4
push 0x4041f0
call sub.msvcrt.dll__initterm
mov eax, dword [0x406784]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x406780]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x4041ec
push 0x4041e8
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x403734
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x403714
cmp cl, 0x22
jne 0x403705
cmp byte [eax], 0x22
jne 0x40371d
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x403728
cmp cl, 0x20
jbe 0x403719
test byte [ebp - 0x54], 1
je 0x40373f
movzx ecx, word [ebp - 0x50]
jmp 0x403742
cmp byte [eax], 0x20
jbe 0x40371d
inc eax
mov dword [ebp - 0x20], eax
jmp 0x403734
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00401bf0
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x403760
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x40379c
mov eax, esi
jmp 0x4037b0
call fcn.004038df
ret
Function at 0x4015d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push edx
push 8
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x424
mov esi, eax
lea eax, [esp + 0x18]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 0x428
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401681
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
nop dword [eax + eax]
mov eax, str.GameApp.dll
lea ecx, [esp + 0x30]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401666
test dx, dx
je 0x401662
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401666
add ecx, 4
add eax, 4
test dx, dx
jne 0x401640
xor eax, eax
jmp 0x40166b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40167d
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x401630
jmp 0x401681
mov ebx, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041107d
mov esp, ebp
pop ebp
ret
Function at 0x411aad
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x411aec
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411aec
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411aec
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x411aec
cmp dword [ecx + 0x74], 0xe
jbe 0x411aec
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x6fb1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006fb140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006fb140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006fb140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006fb140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6fbbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6fbc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x70d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6fbc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6fbc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x42d7bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x42d7cc
pop dword [ebp - 0x2c]
mov eax, 0xa5ff20d9
sub eax, 0xa5bc490d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf5f3e203
sub dword [ebp - 0x3c], 0xa7a19cb8
mov dword [ebp - 0x38], 0xd1920138
sub dword [ebp - 0x38], 0x9f5eb4f3
mov dword [ebp - 0x34], 0x9c51ce93
add dword [ebp - 0x34], 0xaffa759b
mov dword [ebp - 0x30], 0xaf01681a
add dword [ebp - 0x30], 0x50fe97e6
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x9ee4b11d
add dword [ebp - 0x3c], 0xd58db839
mov dword [ebp - 0x38], 0x697c4f54
sub dword [ebp - 0x38], 0x280feddf
mov dword [ebp - 0x34], 0xa775913e
sub dword [ebp - 0x34], 0x440624d2
mov dword [ebp - 0x30], 0x3c303de2
sub dword [ebp - 0x30], 0x3c303de2
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x51a7a
push 0
call eax
mov ecx, 0x5260
xor esi, esi
add esi, eax
mov edi, 0x79d37a89
sub edi, 0x798c1a89
add edi, dword [ebp - 0x2c]
mov ebx, 0xba5f3d0d
add dword [ebp - 0xc], ecx
mov edx, dword [edi]
xor dword [ebp - 8], 0x75f1f3ec
sub edx, ebx
xor dword [ebp - 8], 0x31938eea
mov dword [esi], edx
add esi, 0x48a921bd
sub esi, 0x48a921b9
add edi, 0xcff97ce6
add edi, 0x3006831e
loop 0x42d8da
add eax, 0x13c53
xor ebx, ebx
add ebx, eax
add eax, 0xa948c45c
sub eax, 0xa948c457
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret