joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ccc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x93
mov dword [ebp - 8], 0
jmp 0x1001cce2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x1001cd21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x53062dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001cd1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001ccd9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001cf80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
call fcn.1001cdb0
movzx eax, al
test eax, eax
je 0x1001d08c
mov byte [ebp - 0x34], 0x46
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6c
mov byte [ebp - 0x2f], 0x20
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x20
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x7a
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x21
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x45
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x3a
mov byte [ebp - 3], 0x20
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0
mov ecx, dword [0x10047828]
call fcn.10001480
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [0x1004782c]
call fcn.10013370
mov esp, ebp
pop ebp
ret

Function at 0x1001ed10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046b44]
jne 0x1001ed1a
repz ret
jmp fcn.1001f36c
Function at 0x401000
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [0x4221c0], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041a7d8
add esp, 4
test eax, eax
jne 0x401044
call fcn.004025e4
push 1
call fcn.0041a5ff
add esp, 4
push 0x100
call fcn.0041a6c0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401399
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push 0x4275f0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00402cc9
add esp, 0xc
test eax, eax
jne 0x4010b0
call fcn.004025e4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040150c
add esp, 8
push 1
call fcn.0041a5ff
add esp, 4
call fcn.00405594
test eax, eax
je 0x4010d6
cmp dword [0x427038], 0
jne 0x4010d6
mov eax, dword [ebp + 8]
push eax
call fcn.0040115a
add esp, 4
call fcn.00402dc0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401123
xor eax, eax
mov al, byte [0x4221d1]
test eax, eax
je 0x401123
call fcn.00405594
test eax, eax
je 0x401112
push 0
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00402118
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040150c
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040609f
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041a5ff
add esp, 4
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4026e3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x427038], 0
jne 0x4027dd
call fcn.00405594
test eax, eax
je 0x402714
push 0
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x4027ae
push str.Aladdin_Device_Driver_Installation_Utility_for_Windows_NT
push 0x422180
call fcn.0041abc5
add esp, 8
push 0
push 0x422180
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4027d1
push str.Aladdin_Device_Driver_Installation_Utility_for_Windows_95_98
push 0x422180
call fcn.0041abc5
add esp, 8
push 0
push 0x422180
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4027d1
push str.Aladdin_Device_Driver_Installation_Utility_for_Win32s
push 0x422180
call fcn.0041abc5
add esp, 8
push 0
push 0x422180
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4027d1
cmp dword [ebp - 4], 0
je 0x40277b
cmp dword [ebp - 4], 1
je 0x40274d
cmp dword [ebp - 4], 2
je 0x40271f
jmp 0x4027d1
mov eax, dword [0x4221c0]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404fb6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x404fec
push 0x2000001
call fcn.00405434
add esp, 4
push 0
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x405148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xffffef
cmp eax, 1
je 0x405059
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xffffef
cmp eax, 2
je 0x405059
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xffffef
cmp eax, 4
je 0x405059
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xffffef
cmp eax, 8
je 0x405059
push 0x2000001
call fcn.00405434
add esp, 4
push 0
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x405148
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4050cd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x405088
test byte [ebp - 4], 0x10
jne 0x4050cd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.0041a7d8
add esp, 4
test eax, eax
je 0x4050c4
push 0x2000001
call fcn.00405434
add esp, 4
push 0
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x405148
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x405141
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4050fc
test byte [ebp - 4], 0x10
jne 0x405141
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041a7d8
add esp, 4
test eax, eax
je 0x405138
push 0x2000001
call fcn.00405434
add esp, 4
push 0
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x405148
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
xor eax, eax
jmp 0x405148
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d3e
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov eax, 0x4540f8
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov dx, word [eax + 0xc]
mov word [ecx + 0xc], dx
mov al, byte [eax + 0xe]
mov byte [ecx + 0xe], al
mov dword [ebp - 0xc], 0x378
mov dword [ebp - 8], 0x278
mov dword [ebp - 4], 0x3bc
cmp dword [0x42a18c], 0
jne 0x407da7
call fcn.00408111
cmp eax, 0xffffffff
jne 0x407da7
mov eax, 0xffffffff
jmp 0x407e8a
push 0x454108
push 0x2b
call fcn.00406687
cmp eax, 0xffffffff
jne 0x407dc6
mov eax, 0xffffffff
jmp 0x407e8a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x45410c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x407e02
mov eax, 0xffffffff
jmp 0x407e8a
mov dword [ebp - 0x24], 0
jmp 0x407e11
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jge 0x407e64
push 4
mov eax, dword [ebp - 0x24]
lea eax, [ebp + eax*4 - 0xc]
push eax
push 4
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x407e49
jmp 0x407e64
lea eax, [ebp - 0x1c]
push eax
call fcn.0041a7d8
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
inc byte [ebp + eax - 0x1d]
jmp 0x407e0e
push 0x454144
push 4
call fcn.00406687
cmp eax, 0xffffffff
jne 0x407e83
mov eax, 0xffffffff
jmp 0x407e8a
xor eax, eax
jmp 0x407e8a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408111
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x454214
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408144
xor eax, eax
jmp 0x408267
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0x454248
push 0
push 0x45424c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408189
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x408267
push 0x45426c
call fcn.0041a7d8
add esp, 4
push eax
push 0x454278
push 1
push 0
push 0x454284
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x4081cd
xor eax, eax
jmp 0x408267
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0x45428c
push 0
push 0x454290
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408212
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x408267
push 0x4542c0
call fcn.0041a7d8
add esp, 4
push eax
push 0x4542cc
push 1
push 0
push 0x4542d8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x408260
xor eax, eax
jmp 0x408267
xor eax, eax
jmp 0x408267
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b07
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x408b21
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 3
cmp eax, dword [ebp + 8]
jbe 0x408b48
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov byte [ecx + edx], al
jmp 0x408b1e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], 0x52
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 1], 0x45
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 2], 0x4d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx + 3], 0x20
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 8], eax
push 0x64
push 0x423050
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x45434c
push 0x423050
call fcn.0041a84c
add esp, 8
push str.config.nt
push 0x423050
call fcn.0041a84c
add esp, 8
push 0x423050
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push pe_nt_image_headers32
push 2
push 0x423140
push 0
push 0xc0000000
push 0x423050
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x408bfc
push 0x40003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x408c72
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408c42
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x408c72
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x408c6b
push 0x40005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x408c72
xor eax, eax
jmp 0x408c72
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40921a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call fcn.00409196
cmp eax, 0xffffffff
jne 0x40923b
mov eax, 0xffffffff
jmp 0x40931e
mov eax, dword [0x4230bc]
push eax
call fcn.00414a7b
add esp, 4
cmp eax, 0xffffffff
jne 0x40925c
mov eax, 0xffffffff
jmp 0x40931e
push 0x4544e8
push 0x422f50
call fcn.0041a850
add esp, 8
push 4
push 0x4544f8
push 1
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4092ae
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x40931e
mov eax, dword [0x4230bc]
push eax
call fcn.00414517
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4092d3
mov eax, 0xffffffff
jmp 0x40931e
cmp dword [0x42a190], 0
je 0x4092f4
push 0x4544fc
push 0x30
call fcn.00406687
mov dword [ebp - 4], eax
jmp 0x409303
push 0x45450c
push 0x30
call fcn.00406687
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x409317
mov eax, 0xffffffff
jmp 0x40931e
xor eax, eax
jmp 0x40931e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409323
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x4230bc
push 0x422f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409365
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4093ee
push 0x454518
push 0x422f50
call fcn.0041a850
add esp, 8
push 0xd
push str.Devicehasp
push 1
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4093b7
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4093ee
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4093e7
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4093ee
xor eax, eax
jmp 0x4093ee
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4094d1
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
push 0x422f70
call fcn.0041a850
add esp, 8
push str.Parallel_arbitrator
push 0x422ec0
call fcn.0041a850
add esp, 8
push 0x4230bc
push 0x422f70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409537
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4095e3
push 0x4545ec
push 0x422f50
call fcn.0041a850
add esp, 8
push 0
push 0
mov eax, dword [0x422fd4]
push eax
mov eax, dword [0x4230b8]
push eax
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4095ac
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4095ac
push 0x10004
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4095e3
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4095dc
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4095e3
xor eax, eax
jmp 0x4095e3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4095e8
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov esi, str._SystemRoot_System32Drivers_
lea edi, [ebp - 0x6c]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4d]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x454614
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x45461c
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
cmp dword [ebp + 8], 0
je 0x40967f
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a850
add esp, 8
push 0x454624
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x454628
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push 0x454630
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a84c
add esp, 8
push str.SYSTEMCurrentControlSetServicesEventLogSystem_
push 0x4230d0
call fcn.0041a850
add esp, 8
push 0x45466c
push 0x4230d0
call fcn.0041a84c
add esp, 8
push 0x4230bc
push 0x4230d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4096dc
push 0x10007
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409798
push str.EventMessageFile
push 0x422f50
call fcn.0041a850
add esp, 8
lea eax, [ebp - 0x6c]
push eax
call fcn.0041a7d8
add esp, 4
inc eax
push eax
lea eax, [ebp - 0x6c]
push eax
push 2
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409739
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409798
push str.TypesSupported
push 0x422f50
call fcn.0041a850
add esp, 8
mov dword [ebp - 4], 7
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x422f50
mov eax, dword [0x4230bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409791
push 0x10003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409798
xor eax, eax
jmp 0x409798
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40979d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 0x10c]
push eax
push 0x10008
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x40987c
cmp dword [ebp - 0x108], 0
jne 0x40986a
mov dword [ebp - 0x104], 0x100
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x100]
push eax
push 0
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x103
jne 0x409842
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40986a
cmp dword [ebp - 0x108], 0
jne 0x409865
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x10c]
push eax
call fcn.0040979d
add esp, 8
jmp 0x4097d8
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4098a7
cmp dword [ebp - 0x108], 2
jne 0x409890
xor eax, eax
jmp 0x4098ae
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x4098ae
xor eax, eax
jmp 0x4098ae
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4098b3
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 2
push 1
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409935
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x431
jne 0x40991e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x409965
push 0x20003
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409965
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x40995e
push 0x20004
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409965
xor eax, eax
jmp 0x409965
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40996a
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4099aa
push 0x20005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409a8d
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x409a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x420
jne 0x409a46
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x409a0f
push 0x20006
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409a8d
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x409a41
push 0x20007
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409a8d
jmp 0x409a5d
push 0x20007
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409a8d
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x409a86
push 0x20004
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409a8d
xor eax, eax
jmp 0x409a8d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409a92
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x409aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x409ad3
xor eax, eax
jmp 0x409b71
push 0x20005
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409b71
lea eax, [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x409b41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x41c
je 0x409b41
cmp dword [ebp - 0x24], 0x426
je 0x409b41
push 0x20006
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409b71
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x409b6a
push 0x20004
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x409b71
xor eax, eax
jmp 0x409b71
pop edi
pop esi
pop ebx
leave
ret