joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a960
Capabilities:
Get session user name

Disassembly:
sub esp, 0x208
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [str.system]
mov ecx, dword [0x49ebf4]
mov edx, dword [0x49ebf8]
push ebx
push 0x1f2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ax, word [0x49ebfc]
lea ecx, [esp + 0x1a]
push 0
push ecx
mov dword [esp + 0x1c], edx
mov word [esp + 0x20], ax
call fcn.0047d730
add esp, 0xc
mov dword [esp + 4], 0x100
xor bl, bl
call fcn.00409a50
test eax, eax
jne 0x40a9c6
mov bl, 1
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test bl, bl
pop ebx
je 0x40a9e1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea ecx, [esp + 4]
push ecx
push str..pipeSecureAgeAntivirus
push str._s__s
mov edx, 0x4b2178
call fcn.0040a940
mov ecx, dword [esp + 0x210]
add esp, 0xc
xor ecx, esp
mov eax, 0x4b2178
call fcn.0047a722
add esp, 0x208
ret

Function at 0x40aab0
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
push esi
push edi
push 0xc8
xor edi, edi
call fcn.0047a780
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
je 0x40aae4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov eax, dword [esp + 0xc]
push edi
push edi
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push 0
push 0x1000
push 0x1000
push 0xff
push 0
push 3
push edx
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40ab2c
push eax
call fcn.0047a868
add esp, 4
cmp esi, 0xffffffff
jne 0x40ab39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
test ebx, ebx
je 0x40ab41
mov dword [ebx], edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x40ab50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [ebp]
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push edi
xor esi, esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ac4e
cmp dword [esp + 0x10], ebx
je 0x40ac4e
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40ac4e
cmp eax, dword [esp + 0x14]
jbe 0x40abce
cmp esi, ebx
je 0x40abb3
push esi
call fcn.0047a868
mov eax, dword [esp + 0x20]
add esp, 4
push eax
mov dword [esp + 0x18], eax
call fcn.0047a780
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40ac4e
mov eax, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x14]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ac4e
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40ac4e
push eax
mov eax, dword [ebp + 8]
push esi
push edi
call eax
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp byte [ecx], bl
jne 0x40ac0b
cmp al, bl
sete dl
mov eax, ecx
mov byte [eax], dl
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], bl
jne 0x40ac2d
push ebx
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x28]
push eax
push edi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ab86
jmp 0x40ac4e
mov ecx, dword [ebp + 4]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40ac4e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x40ac70
push esi
call fcn.0047a868
add esp, 4
push ebp
call fcn.0047a868
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x40adf0
Capabilities:
Create thread

Disassembly:
push ecx
push 0xc
call fcn.0047a780
add esp, 4
test eax, eax
jne 0x40ae03
xor al, al
pop ecx
ret
lea ecx, [esp]
push ecx
push 0
push eax
push 0x40ac90
push 0
push 0
mov dword [0x4b1c30], eax
mov dword [0x4b1c28], 0x4a3304
mov dword [eax], str..pipeSecureAgeUniversalAV
mov dword [eax + 4], 0x40afd0
mov byte [eax + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40ae42
mov dword [0x4b1c2c], eax
mov al, 1
pop ecx
ret
Function at 0x40ae50
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1014
call fcn.004891f0
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x1010], eax
mov eax, dword [esp + 0x101c]
push ebx
mov ebx, dword [esp + 0x1024]
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [ebx + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea esi, [esp + 0x1c]
cmp edi, 0x1004
jbe 0x40aead
push edi
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
je 0x40aedf
mov ecx, dword [esp + 0x14]
push ebx
push ecx
lea edx, [esi + 4]
push edx
mov dword [esi], ebx
call fcn.0047d7b0
add esp, 0xc
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40aedf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x40aee3
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
cmp esi, ecx
je 0x40aef8
test esi, esi
je 0x40aef8
push esi
call fcn.0047a868
add esp, 4
mov ecx, dword [esp + 0x1020]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x1014
ret

Function at 0x40af90
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x4b23b4]
test eax, eax
je 0x40afa6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40afc1
push 0
push 0
push 0
push 0x40af20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4b23b4], eax
ret
mov eax, dword [0x4b23b4]
ret
Function at 0x40b4e0
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0xfd]
push ebx
push eax
mov byte [esp + 0x104], bl
call fcn.0047d730
mov eax, str.HARDWAREDESCRIPTIONSystemBIOS
add esp, 0xc
mov dword [esp + 0xc], str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], str.ProcessorNameString
mov dword [esp + 0x1c], str.SystemManufacturer
mov dword [esp + 0x20], str.SystemProductName
cmp byte [0x4b23bc], bl
jne 0x40b658
cmp byte [0x4b23bd], bl
jne 0x40b658
cmp byte [0x4b23be], bl
jne 0x40b658
cmp byte [0x4b23bf], bl
jne 0x40b658
mov ecx, 0x10
mov esi, 0x49d338
lea edi, [esp + 0x38]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
jmp 0x40b5a0
mov edx, dword [esp + edi + 0x18]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + edi + 0x10]
push ebx
push edx
call fcn.0040bc80
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x40b611
mov ecx, 0x49ca47
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b5e2
cmp dl, bl
je 0x40b5de
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b5e2
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x40b5c2
xor eax, eax
jmp 0x40b5e7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x40b611
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b5f0
lea ecx, [esp + 0x28]
push ecx
sub eax, edx
push eax
mov ecx, esi
call fcn.0040f520
push esi
call fcn.0047a868
add esp, 0xc
jmp 0x40b625
lea edx, [esp + 0x28]
push edx
push 7
mov ecx, str.Default
call fcn.0040f520
add esp, 8
add edi, 4
cmp edi, 0xc
jl 0x40b5a0
lea eax, [esp + 0xf8]
push eax
lea ebx, [esp + 0x2c]
call fcn.0040f620
mov ecx, 8
lea esi, [esp + 0xfc]
mov edi, 0x4b23bc
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x4b23bc
call fcn.0047a722
mov esp, ebp
pop ebp
ret

Function at 0x40b7f0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
push 0
push 0xf003f
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x40b841
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x40b850
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40b860
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push ecx
push 0
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x40b8ae
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push eax
push ecx
push 1
push esi
push str.LastScanResult
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x40b8bd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x40b8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b928
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x40b91a
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret

Function at 0x40b930
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b998
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push esi
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x40b98a
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x40b9a0
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b9ec
mov eax, dword [esp + 8]
mov ecx, dword [esp]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x40b9de
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret
Function at 0x40b9f0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x638
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x634], eax
push ebx
mov ebx, dword [esp + 0x644]
push ebp
push esi
mov esi, dword [esp + 0x648]
push edi
push 0x208
xor ebp, ebp
lea ecx, [esp + 0x43e]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x444], ax
call fcn.0047d730
push 0x208
lea eax, [esp + 0x23e]
xor edx, edx
push ebp
push eax
mov word [esp + 0x244], dx
call fcn.0047d730
push 0x208
lea edx, [esp + 0x3e]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x44], cx
call fcn.0047d730
add esp, 0x24
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bb26
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x240]
push edx
push eax
push ecx
mov dword [esp + 0x3c], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, dword [esp + 0x14]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40bb26
lea eax, [esp + 0x18]
push eax
push 0xf003f
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40bae5
inc dword [esp + 0x10]
mov ebp, eax
jmp 0x40ba70
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x22c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x40bb14
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x10]
mov ebp, edi
jmp 0x40ba70
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
jmp 0x40ba70
mov dword [esp + 0x10], 0
mov edi, edi
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bbc0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0x20a
lea eax, [esp + 0x43c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40bbc0
lea ecx, [esp + 0x438]
push ecx
push ebx
push 0x49d768
lea edx, [esp + 0x2c]
push 0x105
push edx
call fcn.0047a84a
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0040b9f0
add esp, 0x1c
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebp, eax
test ebp, ebp
je 0x40bb30
inc dword [esp + 0x10]
jmp 0x40bb30
mov ecx, dword [esp + 0x644]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x638
ret
Function at 0x40bbe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
push 1
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bc5d
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
push ebp
push ecx
mov dword [esp + 0x24], esi
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40bc5c
add eax, 0x10
shr eax, 4
shl eax, 4
push eax
call fcn.0047a780
mov esi, eax
add esp, 4
test esi, esi
je 0x40bc5c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push esi
push 0
push 0
push ebp
push eax
call ebx
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40bc6c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 8
ret

Function at 0x40bc80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 1
xor edi, edi
push edi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x40bd05
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push edi
push edi
push edi
push ebp
push eax
mov dword [esp + 0x28], edi
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bd04
add eax, 0x10
shr eax, 4
shl eax, 4
push eax
call fcn.0047a780
mov edi, eax
add esp, 4
test edi, edi
jne 0x40bcf0
lea esi, [eax + 8]
jmp 0x40bd04
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0
push 0
push ebp
push edx
call ebx
mov esi, eax
pop ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bd14
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40bd1e
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40bd2c
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret

Function at 0x40bf10
Capabilities:
Create directory
Get common file path

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b25f0
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40bf46
test dx, dx
je 0x40bf42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40bf46
add eax, 4
add ecx, 4
test dx, dx
jne 0x40bf20
xor eax, eax
jmp 0x40bf4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40bfb6
push 0x4b25f0
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40bfb6
push esi
push 0x4b25f0
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x49d710
push 0x105
push 0x4b25f0
call fcn.0047ac75
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0xc
push 0
push 0x4b25f0
call esi
push str.SecureAge
push 0x105
push 0x4b25f0
call fcn.0047ac75
add esp, 0xc
push 0
push 0x4b25f0
call esi
pop esi
mov eax, 0x4b25f0
ret
Function at 0x40bfc0
Capabilities:
Get common file path

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b2800
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40bff6
test dx, dx
je 0x40bff2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40bff6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40bfd0
xor eax, eax
jmp 0x40bffb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c00f
push 0x4b2800
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 0x4b2800
ret

Function at 0x40c020
Capabilities:
Create directory
Get common file path

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b2a10
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c056
test dx, dx
je 0x40c052
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c056
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c030
xor eax, eax
jmp 0x40c05b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c0ea
push 0x4b2a10
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40c0ea
push esi
push 0x4b2a10
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x49d710
push 0x105
push 0x4b2a10
call fcn.0047ac75
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0xc
push 0
push 0x4b2a10
call esi
push str.SecureAge
push 0x105
push 0x4b2a10
call fcn.0047ac75
add esp, 0xc
push 0
push 0x4b2a10
call esi
push str.Whitelist
push 0x105
push 0x4b2a10
call fcn.0047ac75
add esp, 0xc
push 0
push 0x4b2a10
call esi
pop esi
mov eax, 0x4b2a10
ret

Function at 0x40c1c0
Capabilities:
Create directory

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b2e30
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c1f6
test dx, dx
je 0x40c1f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c1f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c1d0
xor eax, eax
jmp 0x40c1fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c238
call fcn.0040bf10
push eax
push 0x105
push 0x4b2e30
call fcn.0047a8f6
push str.UniversalAV
push 0x105
push 0x4b2e30
call fcn.0047ac75
add esp, 0x18
push 0
push 0x4b2e30
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x4b2e30
ret

Function at 0x40c2d0
Capabilities:
Create directory

Disassembly:
mov ecx, 0x49c864
mov eax, 0x4b3040
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c306
test dx, dx
je 0x40c302
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c306
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c2e0
xor eax, eax
jmp 0x40c30b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c393
call fcn.0040c020
push eax
push 0x105
push 0x4b3040
call fcn.0047a8f6
add esp, 0xc
mov ecx, 0x49c864
mov eax, 0x4b3040
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c35b
test dx, dx
je 0x40c357
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c35b
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c335
xor eax, eax
jmp 0x40c360
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c393
push 0x4b3040
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.to_be_transferred
push 0x105
push 0x4b3040
call fcn.0047ac75
add esp, 0xc
push 0
push 0x4b3040
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 0x4b3040
ret
Function at 0x40c410
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 4
push eax
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40c467
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40c450
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
push esi
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x40c480
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebx
push esi
push 0xf01ff
push str.SAUAVSvc
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x40c4d7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x424
jne 0x40c4e0
mov eax, dword [esp + 0xc]
push esi
push esi
push esi
push esi
push esi
push eax
push 1
push 2
push 0x10
push 0x200f01ff
push str.SecureAge_UniversalAV_Service
push str.SAUAVSvc
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x40c4d7
call ebx
pop esi
pop ebx
ret
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40c4f0
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf01ff
push str.SAUAVSvc
push eax
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40c537
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40c528
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x40c550
Capabilities:
Delete service

Disassembly:
push ecx
push ebx
push esi
push 0xf01ff
push str.SAUAVSvc
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x40c5b8
lea eax, [esp + 8]
push eax
mov eax, str.SAUAVSvc
mov ecx, edi
call fcn.0040c410
add esp, 4
test eax, eax
jne 0x40c5a3
cmp dword [esp + 8], 1
je 0x40c598
mov eax, edi
call fcn.0040c4f0
mov esi, eax
test esi, esi
jne 0x40c5ab
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40c5ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
pop ebx
add esp, 4
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x40f7a0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret