joyce8/EMBER2024-capa huggingface dataset:
Function at 0x508c6b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + 0xc]
call fcn.0050441f
lea ecx, [eax - 1]
cmp ecx, 4
ja 0x508da1
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jle 0x508d3a
push esi
lea ecx, [ebp + 0xc]
call fcn.0050440c
push eax
push edi
call fcn.00508c05
add esp, 0xc
push esi
lea ecx, [ebp + 0xc]
call fcn.0050442f
push eax
push edi
call fcn.00508c05
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
call fcn.0050736a
mov eax, dword [ebp + 0xc]
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00504e2b
test al, al
je 0x508d2e
and dword [ebp - 8], 0
push esi
lea ecx, [ebp - 0x14]
call fcn.00504316
push eax
push edi
call fcn.00508c05
add esp, 0xc
push esi
lea ecx, [ebp - 0x14]
call fcn.00504329
push eax
push edi
call fcn.00508c05
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00504e2b
test al, al
jne 0x508ce9
push esi
push 0
push edi
call fcn.00508c05
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp + 0xc]
call fcn.00504697
cmp dword [ebp - 4], 0
je 0x508d8a
lea ecx, [ebp - 4]
call fcn.0050441f
push esi
push 1
mov byte [ebp + 0x13], al
lea eax, [ebp + 0x13]
push 1
push eax
call fcn.004c0ba8
mov ecx, dword [ebp - 0xc]
add esp, 0x10
push esi
push dword [ebp - 4]
push edi
call fcn.00508c6b
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.0050451d
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
jne 0x508d4c
push esi
push 1
lea eax, [ebp + 0xb]
push 1
push eax
mov byte [ebp + 0xb], 0
call fcn.004c0ba8
add esp, 0x10
pop edi
pop esi
leave
ret 0xc

Function at 0x509d8f
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x52d693
call fcn.004c5337
fld dword [0x535acc]
mov edi, dword [ebp + 8]
push 0xa
sub esp, 0xc
fstp dword [esp + 8]
mov esi, ecx
fld dword [0x535ac8]
lea ecx, [ebp - 0x50]
fstp dword [esp + 4]
fld dword [0x535ac4]
fstp dword [esp]
push 0x11
call fcn.00508da5
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
push ecx
push eax
mov ecx, esi
call fcn.00509ca1
lea eax, [ebp - 0x50]
push eax
call fcn.00508b7a
mov edx, dword [ebp - 0x4c]
push edi
xor ecx, ecx
inc ecx
push 0x10
mov dword [ebp - 0x14], eax
push ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x6c6d7873
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
call fcn.004c0ba8
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.00508bc5
mov eax, dword [esi]
add esp, 0x1c
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.00508c6b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00509ab3
call fcn.004c53ba
ret 4
Function at 0x50cea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
push dword [ebp + 0x1c]
inc edi
xor esi, esi
mov dword [ebp - 8], esi
push edi
call fcn.0051b414
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x50cecf
xor eax, eax
jmp 0x50cfcf
mov ecx, dword [ebp - 4]
mov eax, SysReAllocString
push 0x40
mov dword [ecx + 0x2a4], eax
mov ecx, dword [ebp - 4]
push 0x50a8b0
push dword [ebp - 4]
mov dword [ecx + 0x2a8], eax
call fcn.0050d565
push esi
push eax
call fcn.0050a970
add esp, 0x14
test eax, eax
je 0x50cf0a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0051b505
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0050d5d6
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00510899
add esp, 0x28
test eax, eax
jne 0x50cf41
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x50cf7f
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0051b5da
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x50cf7f
mov dword [ebp - 8], edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x50cfb6
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0051b5af
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], esi
push dword [ebp - 4]
call fcn.0051b487
add esp, 0x14
jmp 0x50cec8
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.0051b3bf
mov esi, dword [ebp - 4]
add esp, 0x10
call fcn.0050c917
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x50f13e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x50f174
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x50f167
push eax
call fcn.0051b554
push 2
call fcn.0051b540
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.004c5420
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x510e4a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor esi, esi
push dword [ebp + 0x1c]
inc esi
xor edi, edi
mov dword [ebp - 8], edi
push esi
call fcn.0051b414
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x510e79
xor eax, eax
jmp 0x511020
mov ecx, dword [ebp - 4]
mov eax, SysReAllocString
mov dword [ecx + 0x2a4], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2a8], eax
mov eax, dword [ebp - 4]
push 0x40
mov dword [eax + 0x2ac], edi
mov eax, dword [ebp - 4]
push 0x50a8b0
push dword [ebp - 4]
mov dword [eax + 0x2b0], edi
call fcn.0050d565
push edi
push eax
call fcn.0050a970
add esp, 0x14
test eax, eax
je 0x510ec6
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0051b505
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0050d5d6
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00510899
add esp, 0x28
test eax, eax
jne 0x510efd
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x510f3b
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0051b5da
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], edi
jne 0x510f3b
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x50f068
mov eax, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.0050f0b7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xa0], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x510fb8
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push 0x5506fc
push eax
call fcn.00522321
add esp, 0xc
cmp eax, 0xfffffffa
je 0x510fa6
cmp eax, 0xfffffffc
je 0x510f9f
cmp eax, 0xfffffffe
je 0x510f98
cmp eax, edi
je 0x510fb8
push str.Unknown_zlib_error
jmp 0x510fab
push str.zlib_stream_error
jmp 0x510fab
push str.zlib_memory_error
jmp 0x510fab
push str.zlib_version_error
push dword [ebp - 4]
call fcn.0050d605
pop ecx
mov dword [ebp - 8], esi
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
mov eax, dword [ebp - 4]
je 0x510fef
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0051b5af
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], edi
push dword [ebp - 4]
call fcn.0051b487
add esp, 0x14
jmp 0x510e72
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
push edi
push edi
push dword [ebp - 4]
mov dword [ecx + 0x88], eax
call fcn.00517cb7
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x52039a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x520429
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004c4af0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x5203e7
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x52040a
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x520555
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x520451
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x52045c
xor eax, eax
jmp 0x5204a8
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x520479
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00523b28
jmp 0x520489
cmp ecx, 2
jne 0x520492
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00522195
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.004c4af0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edx, dword [esi + 0x74]
cmp edx, 3
jb 0x5204d0
mov edi, dword [esi + 0x6c]
add edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edi]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edi + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edx, 0x106
jae 0x5204e4
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x5203a5
mov ecx, dword [esi + 0x16c0]
mov eax, dword [esi + 0x3c]
cmp ecx, eax
jae 0x520555
mov edi, dword [esi + 0x6c]
add edi, edx
cmp ecx, edi
jae 0x520524
sub eax, edi
mov ebx, eax
mov eax, 0x102
cmp ebx, eax
jbe 0x520509
mov ebx, eax
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.004c5420
add esp, 0xc
add ebx, edi
mov dword [esi + 0x16c0], ebx
jmp 0x520555
lea edx, [edi + 0x102]
cmp ecx, edx
jae 0x520555
sub edi, ecx
add edi, 0x102
sub eax, ecx
cmp edi, eax
jbe 0x52053e
mov edi, eax
mov eax, dword [esi + 0x38]
push edi
add eax, ecx
push 0
push eax
call fcn.004c5420
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
leave
ret
Function at 0xa8d640
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa8d67f
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xaa5483
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00aa5143

Function at 0xaab85c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00aab6db

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40a49e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x40a4e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x3f82
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
push 0x5383
call fcn.0040e12f
add esp, 0x18
jmp 0x40a5a9
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40a536
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
push 0
push dword [ebp - 0x20]
push 0x7d1d
push dword [ebp - 0x24]
push 0x6914
call fcn.00417091
add esp, 0x14
jmp 0x40a5a9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x40a59f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x40a580
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x40a59d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.0042f4bd
mov dword [eax], 3
jmp 0x40a575
jmp 0x40a5a9
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esp, ebp
pop ebp
ret
Function at 0x40eafe
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40eb3c
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push 0
push 0x7e
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00410a1b
add esp, 0x14
jmp 0x40ebf0
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x40ebb4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x55f0
push 0x88f
push 0x39f6
push 0xda6
push 0x7eef
push 0x536d
push 0x8e8
push 0x221f
push 0x1fcb
push 0xdd1
push 0x3459
push dword [ebp - 0x18]
push 0
push 0x6348
push 0x1818
call fcn.00420046
add esp, 0x3c
jmp 0x40ebf0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x40ebd4
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x40ebf0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 1
mov ecx, dword [ebp - 0x30]
call fcn.0042f4bd
mov dword [eax], 0xfffffff7
mov esp, ebp
pop ebp
ret

Function at 0x40f4ca
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x40f57a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40f560
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x40f542
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40f540
push 0
push 1
push 0x3d73
push 0x5eaf
push 0x4780
push 0x545a
call fcn.0042953b
add esp, 0x18
jmp 0x40f55e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x40f55e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x40f578
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x205
push 0
call fcn.004147da
add esp, 0xc
jmp 0x40f5a2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0x1359
push dword [ebp - 0x2c]
push 1
push 1
push dword [ebp - 0x30]
push 0x5f68
call fcn.004087b9
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x410c82
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x410d98
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x410d8b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x410d2b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x410d29
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1fa2
push 0x36d
push 0x1730
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x410d89
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
sub eax, 0x5fe4
cmp eax, 1
jne 0x410d67
mov dword [ebp - 4], 1
jmp 0x410d6b
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0xb8e9646b
je 0x410d7d
mov dword [ebp - 8], 1
jmp 0x410d81
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x410d96
push 0
push 1
call fcn.0040e21a
pop ecx
pop ecx
jmp 0x410db7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
push 0x7578
push dword [ebp - 0x54]
push 0x34b5
push 0
push 1
call fcn.0042ab7f
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x416a40
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x416aa6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x11d7
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x73d4
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00416b6d
add esp, 0x28
jmp 0x416b69
lea eax, [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x416ae1
push 1
push 0xf84
call fcn.00408d81
pop ecx
pop ecx
jmp 0x416b69
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x416b40
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x416b3e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1fa2
push 0x36d
push 0x1730
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x416b69
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 1
mov ecx, dword [ebp - 0x54]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x41758c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x417602
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4175c6
push 0x438c
push 0x5bc3
push 1
call fcn.004176fb
add esp, 0xc
jmp 0x4175fd
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x1fa6
push 1
push 0xc65
push 1
push 0xb8b
push 0x29d4
push dword [ebp - 0xc]
push 1
push 0x75a4
push 0
push 0x1a00
call fcn.0042f1e6
add esp, 0x2c
jmp 0x4176f7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4176cc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4176a2
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x4176ca
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x4176ca
push 0
push 0x9e4
push 0x7f4
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x4176f7
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
push 0x12fc
push 0x5b73
push 0
push dword [ebp - 0x64]
push 0x648b
push dword [ebp - 0x68]
call fcn.004273e5
add esp, 0x18
mov esp, ebp
pop ebp
ret