joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406030
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576637
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f1464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x44c
call fcn.00545d7c
mov edi, eax
mov dword [ebp - 0x14], edi
push 0x44c
push 0
push edi
call fcn.00549a70
add esp, 0x10
mov dword [edi], 0
lea esi, [edi + 0x244]
mov dword [edi + 4], 0xffffffff
mov dword [edi + 0x238], 0xffffffff
mov dword [edi + 0x23c], 0
push esi
push 0x103
mov dword [edi + 0x240], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4060c0
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x4060ec
cmp eax, 0x2f
je 0x4060ec
mov dword [edi + esi*2 + 0x244], 0x2f
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x4061a4
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
push 0x20
setne bl
call fcn.00545d7c
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [eax], 1
mov byte [eax + 0x10], 1
mov byte [eax + 1], bl
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
cmp esi, 0xffffffff
je 0x406168
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov eax, ecx
mov ecx, eax
call fcn.004043e0
mov dword [edi], eax
test eax, eax
je 0x4061a4
push 8
mov dword [0x5fb2b8], 0
call fcn.00545d7c
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x23c]
mov dword [0x5fb2b8], 0x200
test eax, eax
je 0x4061c1
push eax
call fcn.00545b7a
add esp, 4
mov eax, dword [edi + 0x240]
mov dword [edi + 0x23c], 0
test eax, eax
je 0x4061de
push eax
call fcn.00545b7a
add esp, 4
push 0x44c
push edi
mov dword [edi + 0x240], 0
call fcn.00545dac
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x40c346
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x40c335
jg 0x40c2a0
test edx, edx
je 0x40c335
nop dword [eax]
call fcn.0040e670
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40c2f4
jg 0x40c2b7
test esi, esi
je 0x40c2f4
cmp ebx, eax
jg 0x40c2c7
jl 0x40c2c1
cmp edi, esi
jae 0x40c2c7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00549bd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x40c319
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40c32f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x40c2a0
jl 0x40c32f
test edi, edi
jne 0x40c2a0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40c368
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40c36a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x40c3e8
jg 0x40c37d
test esi, esi
je 0x40c3e8
test eax, eax
jl 0x40c3cc
jg 0x40c387
test ebx, ebx
je 0x40c3cc
cmp edi, eax
jg 0x40c397
jl 0x40c391
cmp esi, ebx
jae 0x40c397
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00549bd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40c3e8
jg 0x40c3cf
test esi, esi
je 0x40c3e8
jmp 0x40c3cf
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x40c3e8
push eax
push esi
push 1
push edx
call fcn.00550c4e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x40c432
jl 0x40c425
test ecx, ecx
jne 0x40c432
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40c4f2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.0040e690
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40c49e
jg 0x40c45d
test esi, esi
je 0x40c49e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x40c475
mov eax, dword [esp + 0x10]
jl 0x40c46f
cmp eax, esi
jae 0x40c475
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00549bd0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40c4bf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40c4db
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x40c444
jl 0x40c4db
test ecx, ecx
jne 0x40c444
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40c531
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x40c531
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00549bd0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x40c5a0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x40c557
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x40c589
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0055139f
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x40c5b4
cmp edi, eax
ja 0x40c565
test ecx, ecx
je 0x40c5a0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0055139f
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5f1464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40c950
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40c98c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40c98c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40ca74
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40c9b4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40c9e7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00550160
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x40ca47
sub eax, 1
je 0x40ca47
sub eax, 2
jne 0x40ca74
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00550160
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40ca64
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00550c4e
add esp, 0x10
cmp edi, eax
jne 0x40ca74
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40c977
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 4
Function at 0x40ce80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576e20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f1464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00545d7c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005473c8
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e1c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5f1464]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40e27a
cmp byte [esi + 0x3d], 0
je 0x40e27a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40e268
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40e230
sub eax, 1
je 0x40e234
sub eax, 2
jne 0x40e268
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40e251
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00550c4e
add esp, 0x10
cmp edi, eax
jne 0x40e268
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00545b6c
mov esp, ebp
pop ebp
ret
Function at 0x414f40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x577698
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f1464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
mov eax, edx
lea ebx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414fb0
sub eax, ebx
lea ecx, [esi + 0x18]
sar eax, 1
push eax
push edx
call fcn.0040e810
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [esi + 0x30], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x34], ecx
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57772b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f1464]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 7
mov word [esi + 0x38], ax
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00415ff0
mov dword [esi + 0xd4], 0
xor eax, eax
mov word [esi + 0xd4], ax
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 7
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov eax, esi
mov dword [esi + 0xc], 0x4000
mov dword [esi + 0xd0], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebx + 8]
push edi
call fcn.0055139f
mov esi, dword [ebx + 8]
mov ecx, eax
add esp, 0x10
cmp ecx, 1
sete al
mov byte [ebp - 1], al
mov eax, esi
cdq
idiv dword [ebx + 0x18]
mov dword [ebx + 0x1c], eax
cmp ecx, 1
jne 0x417005
add dword [ebx + 0x14], esi
cmp dword [ebx + 0x4c], 8
push 0xffffffffffffffff
push eax
lea eax, [ebx + 0x38]
push ecx
mov ecx, esp
jb 0x416ed2
mov eax, dword [eax]
mov dword [ecx], eax
mov edx, 0x18
push ecx
mov eax, esp
lea ecx, [ebx + 0x20]
mov dword [eax], str.read
call fcn.00414d30
mov eax, dword [ebx + 0x1c]
add esp, 0x10
mov edx, dword [ebx + 0x18]
xor ecx, ecx
mov dword [ebp - 8], 0
mov esi, edi
mov dword [ebp - 0x10], edx
test eax, eax
je 0x416fb8
mov edi, edx
jmp 0x416f16
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0xc], eax
cmp edx, 1
jne 0x416f25
xor edx, edx
cmp byte [esi], dl
jmp 0x416f2a
xor edx, edx
cmp word [esi], dx
sete dl
mov eax, edi
test edx, edx
je 0x416f5f
test ecx, ecx
je 0x416f53
cmp esi, ecx
je 0x416f53
imul edi, dword [ebp - 8]
mov eax, esi
sub eax, ecx
push eax
push ecx
sub ecx, edi
push ecx
call fcn.00549bd0
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov edx, dword [ebp - 8]
lea ecx, [eax + esi]
inc edx
mov dword [ebp - 8], edx
jmp 0x416f62
mov edx, dword [ebp - 8]
add esi, eax
mov edi, eax
cmp dword [ebp - 0xc], 0
jne 0x416f10
test ecx, ecx
je 0x416f86
cmp esi, ecx
je 0x416f86
sub esi, ecx
imul eax, edx
push esi
push ecx
sub ecx, eax
push ecx
call fcn.00549bd0
add esp, 0xc
mov esi, dword [ebp - 8]
test esi, esi
je 0x416fb5
push 0xffffffffffffffff
push esi
push ecx
mov eax, esp
mov edx, 1
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.nulls_removed
call fcn.00414d30
add esp, 0x10
sub dword [ebx + 0x1c], esi
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x18], 1
jle 0x417005
test byte [ebx + 4], 0x80
je 0x417005
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x416fe2
nop dword [eax + eax]
movzx eax, word [edi + ecx*2 - 2]
dec ecx
rol ax, 8
mov word [edi + ecx*2], ax
test ecx, ecx
jne 0x416fd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [ebx + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.00414d30
add esp, 0x10
mov al, byte [ebp - 1]
test al, al
jne 0x417016
mov ecx, ebx
call fcn.00416710
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4174c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ebx, edi
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
imul eax, edx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
cmovne ebx, eax
xor eax, eax
test byte [esi + 4], 0x80
mov dword [esp + 0xc], eax
je 0x417565
test edi, edi
jne 0x41752b
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545dba
mov ecx, dword [esi + 0x1c]
add esp, 4
add ecx, ecx
mov edi, eax
mov dword [esp + 0xc], edi
push ecx
push ebx
push edi
call fcn.00549bd0
mov edx, dword [esi + 0x1c]
add esp, 0xc
mov ebx, edi
test edx, edx
je 0x417542
nop
movzx eax, word [edi + edx*2 - 2]
dec edx
rol ax, 8
mov word [edi + edx*2], ax
test edx, edx
jne 0x417530
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov eax, esp
xor edx, edx
push ecx
lea ecx, [esi + 0x20]
mov dword [eax], 0
mov eax, esp
mov dword [eax], str.endian_swap
call fcn.00414d30
add esp, 0x10
push dword [esi]
push 1
push dword [esi + 8]
push ebx
call fcn.00550c4e
add esp, 0x10
cmp eax, 1
mov eax, dword [esp + 0xc]
sete bl
test eax, eax
je 0x41758c
push eax
call fcn.00545b7a
add esp, 4
test bl, bl
je 0x4175cf
mov eax, dword [esi + 8]
add dword [esi + 0x14], eax
cmp dword [esi + 0x4c], 8
push 0xffffffffffffffff
push dword [esi + 0x1c]
push ecx
lea ecx, [esi + 0x38]
mov eax, esp
jb 0x4175a9
mov ecx, dword [ecx]
mov dword [eax], ecx
mov edx, 0x18
push ecx
mov ecx, esp
mov dword [ecx], str.write
lea ecx, [esi + 0x20]
call fcn.00414d30
add esp, 0x10
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.00416710
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41ddb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5f1464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x13ec
mov edi, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xc8
call fcn.00545dba
push 0x13ec
mov ebx, eax
push 0
push ebx
call fcn.00549a70
add esp, 0x10
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41de4a
mov edx, ebx
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41de10
mov ecx, dword [ebp - 0x10]
sub edx, esi
sar edx, 1
push edx
push ebx
call fcn.0040e810
push ebx
call fcn.00545b7a
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.00545b7a
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 8
Function at 0x41deb0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x577cbd
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5f1464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0
push 0x5d404c
call fcn.00406440
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x41e092
push 0
push 0
push 0
push 0
push 0
push ebx
push 1
push 2
push 0x10
push 0xf01ff
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ebx, [edi + 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x5d404c
mov ecx, edi
mov dword [ebx], eax
call fcn.00406440
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 8
jb 0x41df7e
lea eax, [ecx + 8]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x41df65
mov eax, dword [edi]
push 8
lea esi, [eax + ecx]
push 0x5db800
push esi
call fcn.00549bd0
add esp, 0xc
mov byte [esi + 8], 0
jmp 0x41df95
push 8
push 0x5db800
mov byte [ebp - 0x2c], 0
mov ecx, edi
push dword [ebp - 0x2c]
push 8
call fcn.00410ca0
mov ebx, dword [ebx]
lea esi, [ebp - 0x13]
nop word [eax + eax]
mov eax, 0xcccccccd
dec esi
mul ebx
shr edx, 3
mov al, dl
shl al, 2
lea ecx, [eax + edx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [esi], bl
mov ebx, edx
test ebx, ebx
jne 0x41dfa0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x40], ebx
mov eax, 0xf
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x50], bl
cmp esi, ecx
je 0x41dfee
mov eax, ecx
lea ecx, [ebp - 0x50]
sub eax, esi
push eax
push esi
call fcn.00406440
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
cmp eax, 0x10
mov dword [ebp - 4], 0
mov esi, dword [edi + 0x14]
lea ecx, [ebp - 0x50]
cmovae ecx, dword [ebp - 0x50]
mov eax, esi
mov edx, dword [edi + 0x10]
sub eax, edx
cmp ebx, eax
ja 0x41e02e
lea eax, [ebx + edx]
mov dword [edi + 0x10], eax
cmp esi, 0x10
jb 0x41e01a
mov edi, dword [edi]
push ebx
lea esi, [edi + edx]
push ecx
push esi
call fcn.00549bd0
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x41e03f
push ebx
push ecx
mov byte [ebp - 0x2c], 0
mov ecx, edi
push dword [ebp - 0x2c]
push ebx
call fcn.00410ca0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
cmp eax, 0x10
jb 0x41e071
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x41e067
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41e0b0
push edx
push ecx
call fcn.00545dac
add esp, 8
mov eax, dword [ebp - 0x30]
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [eax], ebx
mov eax, dword [ebp - 0x34]
sete bl
test eax, eax
je 0x41e08b
push eax
call esi
push dword [ebp - 0x38]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b6c
mov esp, ebp
pop ebp
ret 0x18
call fcn.005500e6
int3