joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10027008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10013a3c
cmp byte [esi + 0x3d], 0
je 0x10013a3c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10013a2a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100139f1
sub eax, 1
je 0x100139f5
sub eax, 2
jne 0x10013a2a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10013a13
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10013a2a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10018459
mov esp, ebp
pop ebp
ret
Function at 0x10013e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x10027900
push 0
call fcn.100183f2
mov edi, eax
mov esi, 1
test edi, edi
je 0x10013fe5
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 4
mov dword [ebp - 4], eax
inc eax
movzx eax, ax
mov dword [ebp + 8], eax
nop dword [eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10013ef1
push ebx
mov edx, eax
mov ecx, edi
call fcn.1000fa10
add esp, 4
test eax, eax
jne 0x10013f0c
push esi
mov ecx, 0x10027900
inc esi
call fcn.100183f2
mov edi, eax
test edi, edi
je 0x10013fe5
mov eax, dword [ebp + 8]
jmp 0x10013ed0
test edi, edi
je 0x10013fe5
mov eax, dword [ebp - 4]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10013fe5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10013fe5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10013fe5
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x10013f75
cmp esi, ecx
jae 0x10013fe5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x10013f63
cmp esi, ecx
jae 0x10013fe5
cmp word [esi], 0
je 0x10013fe5
mov ebx, dword [ebp - 8]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10013fa0
push edi
mov ecx, ebx
call fcn.10014080
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wmemcpy_s]
add esp, 0x10
cmp eax, 0x50
ja case.0x10013fc0.1
movzx eax, byte [eax + 0x10014020]
jmp dword [eax*4 + 0x10014010]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg case.0x10013fc0.20
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.10001760
push 0x80070057
call fcn.10001760
push 0x80004005
call fcn.10001760
nop
invalid

Function at 0x10017ba8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10017b84
pop esi
leave
ret 8
Function at 0x5003972
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x50039b2
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x5003990
and esi, 3
xor eax, eax
dec esi
je 0x50039ce
dec esi
je 0x50039c7
dec esi
jne 0x50039d3
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc

Function at 0x1b63700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.01b6378f
jae 0x1b6370e
xor ecx, ecx
call fcn.01b6378f
jae 0x1b6373d
xor eax, eax
call fcn.01b6378f
jae 0x1b6374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.01b6378f
adc al, al
jae 0x1b6372f
jne 0x1b63779
stosb byte es:[edi], al
jmp 0x1b63711
call fcn.01b6379b
sub ecx, ebx
jne 0x1b63756
call fcn.01b63799
jmp 0x1b63775
lodsb al, byte [esi]
shr eax, 1
je 0x1b63783
adc ecx, ecx
jmp 0x1b63772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01b63799
cmp eax, 0x7d00
jae 0x1b63772
cmp ah, 5
jae 0x1b63773
cmp eax, 0x7f
ja 0x1b63774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b63711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40224c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40228b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40228b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40228b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40228b
cmp dword [ecx + 0x74], 0xe
jbe 0x40228b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x404c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404c39
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404c74
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404c70
lea ebx, [ebx]
cmp esi, eax
jae 0x404c74
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404c60
cmp esi, eax
jb 0x404c7a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406050
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x45b500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00432195
mov dword [esp + 0x38], 0
call fcn.0042ae70
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406097
push 0x80004005
call fcn.00405760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.0042f25a
add esi, 0x64
push esi
lea ecx, [esp + 0x20]
call fcn.0043242b
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax - 0xc]
push 0xc00
lea edx, [esp + 0x10]
push edx
push ecx
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x68]
lea ecx, [esp + 0x2c]
call edx
push esi
lea ecx, [esp + 0x20]
call fcn.0043242b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
add eax, 0x13
mov dword [esp + 0x14], eax
sub eax, dword [esp + 0xc]
mov byte [esp + 0x38], 0
mov dword [edi], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [edi + 4], ecx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406132
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.004321e9
mov ecx, dword [esp + 0x30]
mov eax, edi
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
Function at 0x406e90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
cmp dword [edi + 0x64], 0
push ebx
push esi
jne 0x406ead
cmp dword [edi + 0x20], 0
je 0x406ead
push edi
call fcn.004070d0
mov ecx, dword [edi + 0x58]
mov ebx, dword [edi + 0x54]
xor eax, eax
cmp dword [edi + 0x64], eax
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
jle 0x406fa5
lea edx, [ecx - 0x7b2]
mov dword [esp + 0xc], edx
jmp 0x406eda
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
test eax, eax
jl 0x406fb9
cmp eax, dword [edi + 0x64]
jge 0x406fb9
cmp dword [esp + 0xc], 0x406
mov edx, dword [edi + 0x60]
mov eax, dword [edx + eax*4]
mov dword [esp + 0x14], eax
ja 0x406f02
mov dword [eax + 0x64], ecx
mov esi, eax
call fcn.0041b950
lea eax, [ebx - 1]
cmp eax, 0xb
ja 0x406f18
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x60], ebx
mov edx, dword [esp + 8]
mov eax, dword [edi + 0x20]
mov ecx, edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
call fcn.004311f7
mov ecx, dword [edi + 0x20]
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0042e101
mov ecx, edi
mov esi, eax
call fcn.004311f7
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esi + 0x20]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov dword [edx + 0x54], ecx
mov ecx, 1
add ebx, ecx
cmp ebx, 0xd
jne 0x406f92
add dword [esp + 8], ecx
add dword [esp + 0xc], ecx
mov ebx, ecx
mov eax, dword [esp + 0x10]
add eax, ecx
cmp eax, dword [edi + 0x64]
mov dword [esp + 0x10], eax
jl 0x406ed2
mov eax, dword [edi + 0x20]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042adb3
int3
Function at 0x407a80
Capabilities:
Get geographical location

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45b588
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [esi + 0x5c], ebx
jne 0x407c7b
call fcn.0042ae70
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x407abe
push 0x80004005
call fcn.00405760
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push ebp
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push ebx
push ebx
mov dword [esp + 0x3c], ebx
mov ecx, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0x146
push ecx
call ebp
mov dword [esp + 0x14], eax
xor eax, eax
push 0x14
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
lea eax, [esp + 0x1c]
push eax
push 0xc
xor edx, edx
push 0x400
mov word [esp + 0x28], dx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.00404ea0
mov byte [esp + 0x34], 1
mov edx, dword [esp + 0xc]
cmp dword [edx - 0xc], ebx
jne 0x407b4f
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xc], 0x3b
mov byte [esp + 0xd], bl
call fcn.00407ec0
push edi
lea ebx, [esp + 0x10]
call fcn.00407ce0
push 0x20
mov ecx, ebx
call fcn.00407e40
mov ebx, dword [esp + 0x18]
xor edi, edi
test ebx, ebx
jle 0x407c18
mov ecx, dword [esi + 0x20]
push 0
push edi
push 0x150
push ecx
call ebp
test eax, eax
je 0x407c0f
call fcn.0042ae70
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x407c8b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
push ecx
push edi
mov ecx, esi
mov byte [esp + 0x40], 2
call fcn.0042b82d
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
je 0x407bd8
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004045d0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004045d0
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc edi
cmp edi, ebx
jl 0x407b70
lea edx, [esp + 0x14]
lea ecx, [esi + 0x58]
push edx
call fcn.00405000
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esi + 0x5c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407c79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebp
mov ecx, dword [esp + 0x28]
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
push 0x80004005
call fcn.00405760
int3
Function at 0x4080d0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push esi
push 1
push 0
push 0
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x40812c
push ebp
push edi
push 0x80000000
push str.GnotasSvc
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x408127
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x14], 4
jne 0x408124
cmp dword [esp + 0x10], 0x10
jne 0x408124
mov bl, 1
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret

Function at 0x408280
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
xor eax, eax
push ebx
push esi
push eax
push eax
push 1
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4082c2
xor ecx, ecx
lea eax, [ecx + 4]
call fcn.00408140
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xc]
push edx
mov edx, dword [ebp + 8]
push 0x1002
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [edi + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x408319
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x408319
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov eax, 2
call fcn.00408140
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x14]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x408357
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
xor eax, eax
call fcn.00408140
test esi, esi
jne 0x40837c
mov ecx, dword [edi + 8]
push esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x408388
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebx
mov eax, 2
call fcn.00408140
mov edx, dword [ebp + 0x10]
mov al, byte [edx]
cmp al, 3
ja 0x4083ac
jne 0x4083a5
cmp dword [esp + 8], 0x1002
jne 0x4083ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esp + 8], 2
je 0x40839d
xor ecx, ecx
lea eax, [ecx + 5]
call fcn.00408140
int3
Function at 0x408e90
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
push edi
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareStridensGnotas2
push 0x80000001
call ebp
mov eax, dword [ebx + 0x104]
mov ecx, dword [eax - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ecx + ecx + 2]
push edx
push eax
mov eax, dword [esp + 0x14]
push 3
push 0
push str.Directorio
push eax
call edi
mov ecx, dword [esp + 0xc]
push 0xe8
push ebx
push 3
push 0
push str.Configuracion
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareStridensGnotas2Perfiles
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareStridensGnotas2Perfiles
push 0x80000001
call ebp
mov esi, dword [ebx + 0x10c]
test esi, esi
je 0x408f65
lea ebx, [ebx]
mov eax, esi
test esi, esi
je 0x408fe1
mov eax, dword [eax + 8]
mov edx, dword [esp + 0xc]
mov esi, dword [esi]
push 0x18
lea ecx, [eax + 0x34]
push ecx
push 3
push 0
push eax
push edx
call edi
test esi, esi
jne 0x408f40
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareStridensGnotas2Alarmas
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareStridensGnotas2Alarmas
push 0x80000001
call ebp
mov esi, dword [ebx + 0xec]
test esi, esi
je 0x408fd1
lea ebx, [ebx]
mov eax, esi
test esi, esi
je 0x408fe1
mov eax, dword [eax + 8]
mov esi, dword [esi]
push 0x24
lea edx, [eax + 0x7c]
push edx
push 3
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
call edi
test esi, esi
jne 0x408fb0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ecx
ret
call fcn.0042adb3
int3

Function at 0x40a460
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
cmp byte [0x47b6f8], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40a4de
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x47b378
push 0x80000001
call esi
test eax, eax
jne 0x40a4d7
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x47ed38
push eax
push eax
push str.ContadorNotas
push edx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a4d0
mov dword [0x47ed38], 1
mov eax, dword [esp + 8]
push eax
call edi
mov byte [0x47b6f8], 0
inc dword [0x47ed38]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x47b378
push 0x80000001
call esi
mov edx, dword [esp + 8]
push 4
push 0x47ed38
push 3
push 0
push str.ContadorNotas
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 8]
push eax
call edi
mov eax, dword [0x47ed38]
pop edi
pop esi
add esp, 8
ret
Function at 0x40a540
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp byte [0x47b71a], bl
je 0x40a5bc
push ebx
lea eax, [esp + 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x47b378
push 0x80000001
call edi
test eax, eax
jne 0x40a5b6
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x47ed30
push ebx
push ebx
push str.CoordenadasAUC
push edx
mov dword [esp + 0x28], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a5af
mov dword [0x47ed34], ebx
mov dword [0x47ed30], ebx
mov eax, dword [esp + 0xc]
push eax
call ebp
mov byte [0x47b71a], bl
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, 0x1e
add dword [0x47ed30], eax
add dword [0x47ed34], eax
push ebx
call esi
sub eax, dword [esp + 0x1c]
cmp dword [0x47ed30], eax
jle 0x40a5e9
mov dword [0x47ed30], ebx
push 1
call esi
sub eax, dword [esp + 0x20]
pop esi
cmp dword [0x47ed34], eax
jle 0x40a600
mov dword [0x47ed34], ebx
push ebx
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x47b378
push 0x80000001
call edi
mov edx, dword [esp + 0xc]
push 8
push 0x47ed30
push 3
push ebx
push str.CoordenadasAUC
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0xc]
push eax
call ebp
mov eax, dword [0x47ed30]
mov edx, dword [0x47ed34]
pop edi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x40ac10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00435271
Function at 0x40f960
Capabilities:
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x45ad78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.00434d35
lea eax, [esi + 0x78]
push eax
lea ecx, [esp + 0xc]
push 0x4664f0
push ecx
call fcn.00404440
add esp, 0xc
mov dword [esp + 0x14], 0
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004311b0
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f9cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004331c0
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0xb8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xa2
push eax
push 0x467
push ecx
call edi
mov edx, dword [esi + 0x10c]
push 0x640000
push 0
push 0x401
push edx
call edi
push str.Conectando_con_el_programa_de_servicio...
lea ecx, [esi + 0x194]
call fcn.004311b0
push 0
push 4
push 0
push 0
push esi
push 0x40fc70
call fcn.00436d36
mov dword [esi + 0x20c], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0x20c]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret