joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410610
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x44dd94]
xor eax, esp
mov dword [esp + 0x620], eax
mov eax, dword [esp + 0x62c]
push edi
mov edi, dword [esp + 0x62c]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push str.DeviceHarddisk_dPartition_d
push eax
call fcn.00418d29
add esp, 0x10
cmp eax, 2
je 0x410668
xor eax, eax
pop edi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0041851b
add esp, 0x624
ret
lea eax, [esp + 0x41c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x410650
push esi
lea ecx, [esp + 0x420]
push ecx
push str._sTrueCrypt_Write_Protection_Removal.cmd
lea edx, [esp + 0x18]
push 0x208
push edx
call fcn.00418c10
lea eax, [esp + 0x430]
push eax
push str._sTrueCrypt_Write_Protection_Removal.diskpart
lea ecx, [esp + 0x230]
push 0x208
push ecx
call fcn.00418c10
lea edx, [esp + 0x30]
push 0x435444
push edx
call fcn.004186e1
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x4106f5
push edi
call fcn.0040f840
add esp, 4
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0041851b
add esp, 0x624
ret
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x21c]
push ecx
mov edx, ecx
push edx
push str._diskpart__s___s__n_pause_n_del___s____s_
push esi
call fcn.004196a7
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0040fec0
push esi
call fcn.004185a1
lea ecx, [esp + 0x238]
push 0x435444
push ecx
call fcn.004186e1
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x410769
push edi
call fcn.0040f840
add esp, 4
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0041851b
add esp, 0x624
ret
mov eax, dword [esp + 8]
push eax
push str.select_disk__d_nattributes_disk_clear_readonly_n
push esi
call fcn.004196a7
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x410793
push eax
push str.select_partition__d_nattributes_volume_clear_readonly_n
push esi
call fcn.004196a7
add esp, 0xc
push str.exit_n
push esi
call fcn.004196a7
lea ecx, [esp + 0x220]
push ecx
push esi
call fcn.0040fec0
push esi
call fcn.004185a1
add esp, 0x14
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4107cd
call fcn.00410180
test eax, eax
mov eax, str.runas
jne 0x4107d2
mov eax, 0x4356f0
push 5
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x628]
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041851b
add esp, 0x624
ret
Function at 0x414130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push SysStringLen
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414191
mov eax, dword [esp + 0x18]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414197
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0xc
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 8], 4
sete al
add esp, 0xc
ret

Function at 0x4141b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push SysStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4141f3
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
push esi
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x41422d
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x41851b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44dd94]
jne 0x418525
repz ret
jmp fcn.0041f98c

Function at 0x41a766
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41a797
call fcn.0041cc04
mov dword [eax], esi
call fcn.0041cbf1
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041804e
add esp, 0x14
push 0x16
pop eax
jmp 0x41a7ec
test dword [ebp + 0xc], 0xfffffff9
jne 0x41a773
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a7c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041cc17
pop ecx
call fcn.0041cbf1
mov eax, dword [eax]
jmp 0x41a7ec
test al, 0x10
jne 0x41a7ea
test al, 1
je 0x41a7ea
test byte [ebp + 0xc], 2
je 0x41a7ea
call fcn.0041cc04
mov dword [eax], 5
call fcn.0041cbf1
mov dword [eax], 0xd
jmp 0x41a7bb
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41a825
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41a856
call fcn.0041cc04
mov dword [eax], esi
call fcn.0041cbf1
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041804e
add esp, 0x14
push 0x16
pop eax
jmp 0x41a8ab
test dword [ebp + 0xc], 0xfffffff9
jne 0x41a832
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41a883
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041cc17
pop ecx
call fcn.0041cbf1
mov eax, dword [eax]
jmp 0x41a8ab
test al, 0x10
jne 0x41a8a9
test al, 1
je 0x41a8a9
test byte [ebp + 0xc], 2
je 0x41a8a9
call fcn.0041cc04
mov dword [eax], 5
call fcn.0041cbf1
mov dword [eax], 0xd
jmp 0x41a87a
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42c3f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041f1ae
and dword [ebp - 4], 0
cmp dword [0x47ad84], 0
mov ebx, eax
jne 0x42c4a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42c557
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x446b50
push edi
call esi
test eax, eax
je 0x42c557
push eax
call fcn.0041f13c
mov dword [esp], 0x446b40
push edi
mov dword [0x47ad84], eax
call esi
push eax
call fcn.0041f13c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47ad88], eax
call esi
push eax
call fcn.0041f13c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47ad8c], eax
call esi
push eax
call fcn.0041f13c
pop ecx
mov dword [0x47ad94], eax
test eax, eax
je 0x42c4a6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f13c
pop ecx
mov dword [0x47ad90], eax
mov eax, dword [0x47ad90]
cmp eax, ebx
je 0x42c4fe
cmp dword [0x47ad94], ebx
je 0x42c4fe
push eax
call fcn.0041f1b7
push dword [0x47ad94]
mov esi, eax
call fcn.0041f1b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42c4fe
test edi, edi
je 0x42c4fe
call esi
test eax, eax
je 0x42c4f5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42c4f5
test byte [ebp - 0xc], 1
jne 0x42c4fe
or dword [ebp + 0x10], 0x200000
jmp 0x42c537
mov eax, dword [0x47ad88]
cmp eax, ebx
je 0x42c537
push eax
call fcn.0041f1b7
pop ecx
test eax, eax
je 0x42c537
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42c537
mov eax, dword [0x47ad8c]
cmp eax, ebx
je 0x42c537
push eax
call fcn.0041f1b7
pop ecx
test eax, eax
je 0x42c537
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47ad84]
call fcn.0041f1b7
pop ecx
test eax, eax
je 0x42c557
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42c559
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b11c
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x82
or dword [edi + ebx*2 - 0x93ecc9f], ebp
adc al, 0xb1
in eax, dx
sub dx, sp
Function at 0x45577c
Capabilities:
Encode data using xor

Disassembly:
invalid
in al, dx
test dword [edi + 0x2ff8a188], esp
adc esi, dword [edx]
int1
sub ch, byte [esi + 0x6b7e80d2]
pop edi
cmp eax, dword [eax + 0x32]
clc
adc byte [edi], ch
push ebx
mov ah, 0x29
or eax, 0xab635f2d
sbb byte [eax - 0x18], 0x6b
lodsb al, byte [esi]
jb 0x4557ba
push 0xffffffffffffff86
pushfd
cmpsb byte [esi], byte es:[edi]
jle 0x4557ea
or al, byte [ecx + ebp*8]
adc dh, byte [edi - 0x7b9ac1be]
dec esp
sbb al, 0x22
cmpsb byte [esi], byte es:[edi]
and al, 0x51
btr dword [ebx - 0x59976ee4], ebx
cwde
push 0xffffffffffffffbf
sti
sub edi, dword [esi + 0x701fd30d]
jnp 0x455744
mov dword [eax], ebx
out 0x35, al
wait
insd dword es:[edi], dx
dec ebp
push ebx
test eax, 0xc2d2b831
or byte [edi], al
loop 0x45573d
leave
xchg dword [edx], eax
wait
stosd dword es:[edi], eax
aam 0x67
lds esi, [esi + 0x3d]
mov ch, 0x1c
lcall 0x2cea, 0x5af20712
inc ebp
dec ecx
rcl dword [edi + 7], 8
mov esp, 0xc74c8332
mov edx, 0x959407ac
push edi
pop es
or byte [edx + esi - 0x4538b37d], bh
lodsb al, byte [esi]
pop es
xchg esp, eax
xchg ebp, eax
lodsb al, byte [esi]
xor al, 0x4d
mov bl, 0xc6
push dword [edx + eax*2 - 0x1efd953e]
adc al, 0x8d
xor bl, byte [ecx + 0x29745317]
inc ebp
test dword [edi + 0x38], esp
imul ecx, dword [eax - 0x7e], 0x76
invalid
inc edx
ret 0x26a
dec eax
xor byte [esi - 0x10], 0x61
pop edx
lodsd eax, dword [esi]
mov cl, 0xc3
mov dword [0xe0e23f62], eax
bound edi, qword [edi]
loop 0x4557ce
and al, 0x46
sti
jp 0x4557e0
pop edi
movsb byte es:[edi], byte [esi]
mov ebp, 0x62ca12df
jmp 0x455836
adc ah, ch
fldcw word [ebp + 0x20]
pushfd
mov es, word [edx + 0x2e]
push dword [ecx]
mov byte [edx], dl
xchg ebx, eax
inc ebx
popfd
sub dl, byte [esi]
fadd qword [eax + 0x50395314]
inc edx
inc edx
retf 0x6eea

Function at 0x4eaa1c
Capabilities:
Encode data using xor

Disassembly:
pop ds
mov ch, 0x9e
cli
push 0xf
jbe 0x4ea9a3
sti
push cs
stosd dword es:[edi], eax
fldenv [ebx - 0x1e685107]
mov esi, 0xbce9ec5
xor ebp, dword [ebp - 0x714f4cfe]
and edx, dword [eax - 0x2d5f3ee]
cmp eax, 0xe4e57b0b
movsb byte es:[edi], byte [esi]
add eax, 0x98bed02d
add byte [ecx], ah
test eax, 0x48d6b6c1
cld
scasb al, byte es:[edi]
adc dword [edi + 0x2e], 0xffffffd6
Function at 0x5363fc
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
hlt
lea ebx, [ebp - 0x37]
insd dword es:[edi], dx
mov ah, 0x2d
stc
arpl word [esp + eax], sp
sub eax, 0x42463f9
rcl dword [ebp + 0x24a9bd3b], 0x1c
sal edi, 0x63
je 0x5363b2
popal
invalid
lds ebp, [eax + 0x10]
call 0xfbc2e119
call esp
out 0xe2, al
jno 0x536392
jecxz 0x5363ac
je 0x2e27199a
or eax, 0x6205e055
push ebp
inc ebx
mov ah, 0xe3
test dword [ebp - 0x51], ecx
cld
in eax, 0xac
shl byte [esi + 0x54], 0xd9
imul edi, dword [esi + esi*2], 0x67e115f6

Function at 0x6040d7
Capabilities:
Encode data using xor

Disassembly:
mov byte [eax + ebp + 0x53], bl
and eax, 0xe26407ad
dec eax
mov bl, cl
mov dl, 0x1b
invalid

Function at 0x64e121
Capabilities:
Encode data using xor

Disassembly:
test byte [ebx - 0x1848b2b5], bh
dec esi
adc ebx, eax
cmova esi, dword [edi]
mov bl, 0xb0
mov dl, byte [ecx + ecx*4 - 0x243936d]
aas
cmpsb byte [esi], byte es:[edi]
pop esi
xchg ebx, eax
insb byte es:[edi], dx
mov esp, 0x5ea63ffd
sbb dword [ebp + 0x3c], esi
mov dh, 0x6d
outsd dx, dword [esi]
add dl, byte [ecx]
test eax, 0x1fcde733
pushfd
lea ecx, [ebx - 0x19]
dec ebx
out 0x78, eax
invalid
push ebx
mov ebp, edx
xchg ebp, eax
popfd
and edx, dword [ebx]
xlatb
imul ebx, dword [edi + 0x400b8964], 0x62755605
and dword [edi], edx
test al, 0x80
dec eax
mov dl, 0x4d
loop 0x64e0f9
cmp dword [ebp + 0xe], ecx
mov esi, 0xa5f38418
and eax, dword [edx - 0x5fad08a5]
push edx
mov al, byte [0x86a802d2]
push edx
mov al, byte [0x86a802d2]
dec edi
mov al, byte [0x5c6f318c]
dec eax
jnp 0x64e194
invalid
aaa
jecxz 0x64e10a
lahf
int1
retf
mov esi, ebp
lcall 0x9ffd, 0x5ba10eb
sti
pop ds
cmpsb byte [esi], byte es:[edi]
ror byte [edi], cl
invalid

Function at 0x64ea9d
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x9b
cmpsd dword [esi], dword es:[edi]
and ecx, dword [ebx - 0x5a]
jo 0x64ea7f
adc bh, dh
je 0x64ea78
mov ecx, 0x9067e433
wait
push ebp
nop
pop ecx
imul eax, dword [ecx + 0x10], 0xfffffff4
sbb dword [edi + 6], edx
mov eax, 0xa95bcbb
dec ecx
dec edi
out 0xa3, al
dec edi
dec esp
fisttp word [ecx - 0x2e]
sti
bound edx, qword [edi - 0x5e99df37]
jns 0x64ea75
or byte [ebp - 0x62b28b17], bh
push ecx
pop eax
aaa
dec ebp
arpl word [edx], ax
cmpsb byte [esi], byte es:[edi]
out dx, eax
mov dl, ch
push ecx
invalid
Function at 0x4013c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x422240]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x550], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401f60
add esp, 4
test eax, eax
je 0x4013f2
jmp 0x4015b4
mov ecx, dword [ebp + 8]
push ecx
push str._s
push 0x200
lea edx, [ebp - 0x404]
push edx
call fcn.00402390
add esp, 0x10
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0xffffffff
jne 0x401437
jmp 0x4015b4
push 0x422198
lea edx, [ebp - 0x518]
push edx
call fcn.00406e70
add esp, 8
test eax, eax
je 0x40158a
push 0x42219c
lea eax, [ebp - 0x518]
push eax
call fcn.00406e70
add esp, 8
test eax, eax
je 0x40158a
lea ecx, [ebp - 0x518]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.00402390
add esp, 0x14
mov ecx, dword [ebp - 0x544]
and ecx, 0x10
je 0x4014be
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.004013c0
add esp, 0x10
jmp 0x40158a
cmp dword [ebp - 0x550], 0
jne 0x4014dd
mov eax, dword [ebp + 8]
push eax
call fcn.00401ed0
add esp, 4
mov dword [ebp - 0x550], 1
push 0x34
call fcn.004070ff
add esp, 4
mov dword [ebp - 0x548], eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00406efc
add esp, 4
mov edx, dword [ebp - 0x548]
mov dword [edx], eax
push 0x20
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x548]
add ecx, 4
push ecx
call fcn.004047c0
add esp, 0xc
push 0x10
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x548]
add eax, 0x24
push eax
call fcn.004047c0
add esp, 0xc
push 0x423600
mov ecx, dword [ebp - 0x548]
push ecx
push 0x401b80
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0
je 0x40156a
mov edx, dword [ebp - 0x554]
push edx
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
nop
jmp 0x40158a
mov eax, dword [ebp - 0x548]
mov ecx, dword [eax]
push ecx
call fcn.004070e4
add esp, 4
mov edx, dword [ebp - 0x548]
push edx
call fcn.004070e4
add esp, 4
lea eax, [ebp - 0x544]
push eax
mov ecx, dword [ebp - 0x54c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401437
mov edx, dword [ebp - 0x54c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402424
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x422240]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401d21
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
nop
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402424
mov esp, ebp
pop ebp
ret

Function at 0x401d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x422240]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00401cb0
test eax, eax
jne 0x401dea
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401dea
mov dword [ebp - 0x144], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x140]
push ecx
call fcn.00404fb0
add esp, 0xc
mov dword [ebp - 0x138], str.runas
lea edx, [ebp - 0x108]
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], 0x422064
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401de2
push 1
call fcn.00407445
nop
push 0
call fcn.00407445
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402424
mov esp, ebp
pop ebp
ret

Function at 0x401e00
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x422240]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x401eb7
mov dword [ebp - 0x10], str.wuauserv
mov dword [ebp - 0xc], str.bits
mov dword [ebp - 8], str.cryptsvc
mov dword [ebp - 0x30], 0
jmp 0x401e53
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jae 0x401eac
push 0x24
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp + ecx*4 - 0x10]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x401eaa
lea ecx, [ebp - 0x2c]
push ecx
push 1
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401e9f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x10]
push ecx
push str.Service__s_stopped_successfully._n
call fcn.00402350
add esp, 8
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x401e4a
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402424
mov esp, ebp
pop ebp
ret
Function at 0x402000
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x402067
mov ecx, dword [ebp + 8]
push ecx
push 0x20
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp + 0xc]
push eax
push 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.00401b20
add esp, 8
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401b20
add esp, 8
jmp 0x40207c
push str.Failed_to_acquire_cryptographic_context._n
call fcn.00402350
add esp, 4
push 1
call fcn.00407445
nop
mov esp, ebp
pop ebp
ret

Function at 0x4020b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x422240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 2
jge 0x4020f7
call fcn.00401d40
push 0
push 0
push 0x4221d4
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x4021b3
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.00402000
add esp, 8
call fcn.00401e00
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.00402080
add esp, 8
call fcn.00401bd0
push str.__food
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx]
push ecx
call fcn.00406e70
add esp, 8
test eax, eax
jne 0x402155
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.004017d0
add esp, 0xc
jmp 0x4021ac
push str.__rest
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx]
push eax
call fcn.00406e70
add esp, 8
test eax, eax
jne 0x402189
push 1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.004017d0
add esp, 0xc
jmp 0x4021ac
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
push edx
push str.Invalid_parameter:__s_n
call fcn.00402350
add esp, 8
mov eax, 1
jmp 0x4021b3
call fcn.00401c80
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402424
mov esp, ebp
pop ebp
ret

Function at 0x402fd8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403017
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403017
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403017
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403017
cmp dword [ecx + 0x74], 0xe
jbe 0x403017
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40d2c0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bdf8
push 0x41bdf0
push str.FlsAlloc
push 0x1f
call fcn.0040d17f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d2f4
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1b4]
call esi
jmp 0x40d2fa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d33e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41be08
push 0x41be00
push str.FlsGetValue
push 0x21
call fcn.0040d17f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d375
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a1b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d37d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41be10
push 0x41be08
push str.FlsSetValue
push 0x22
call fcn.0040d17f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3b7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41a1b4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]