joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x43200c]
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x8000
push section..rdata
call sub.SHELL32.dll_SHGetKnownFolderPath
xor esi, esi
test eax, eax
js 0x40b52a
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00416709
add esp, 4
cmp eax, 0x105
jb 0x40b53e
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x105
push ebx
push edi
call fcn.00416b82
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Mozilla_Maintenance_Service
push edi
call fcn.0040c1f0
add esp, 8
test eax, eax
je 0x40b52a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b582
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b52a
push str.UpdateLogs
push edi
call fcn.0040c1f0
add esp, 8
test eax, eax
je 0x40b52a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b5b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b52a
xor esi, esi
inc esi
jmp 0x40b52a
Function at 0x40bbe0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x43200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push 5
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x40bcaa
mov ebx, eax
push 4
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40bcd0
mov ecx, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x30], 0xcf
imul esi, ecx, 0x3e8
test esi, esi
je 0x40bcf8
mov dword [ebp - 0x3c], ebx
xor ebx, ebx
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x38]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40bc61
cmp dword [ebp - 0x30], 1
jne 0x40bc8d
jmp 0x40bca2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jle 0x40bd33
lea ecx, [eax - 0x41c]
cmp ecx, 0xa
ja 0x40bd60
mov edx, 0x601
bt edx, ecx
jae 0x40bd60
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x32
cmp ebx, esi
jb 0x40bc42
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
jmp 0x40bd99
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
mov esi, 0xfd
sete cl
xor ecx, 0xff
cmp eax, 5
cmovne esi, ecx
jmp 0x40bda8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x40bd04
cmp edi, 5
je 0x40bd1b
cmp edi, 6
jne 0x40bd2c
mov esi, 0xec
jmp 0x40bda8
mov dword [ebp - 0x40], 0xcf
jmp 0x40bd99
cmp edi, 0x7b
je 0x40bd25
cmp edi, 0x424
jne 0x40bd2c
mov esi, 0xee
jmp 0x40bda8
mov esi, 0xeb
jmp 0x40bda8
mov esi, 0xed
jmp 0x40bda8
mov esi, 0xef
jmp 0x40bda8
cmp eax, 0x56
jg 0x40bd4c
mov ebx, dword [ebp - 0x3c]
cmp eax, 5
je 0x40bd76
cmp eax, 6
jne 0x40bd8e
mov eax, 0xd9
jmp 0x40bd93
mov ebx, dword [ebp - 0x3c]
cmp eax, 0x57
je 0x40bd7d
cmp eax, 0x7a
jne 0x40bd8e
mov eax, 0xdb
jmp 0x40bd93
cmp eax, 0x7c
je 0x40bd84
mov ebx, dword [ebp - 0x3c]
cmp eax, 0x45b
jne 0x40bd8e
mov eax, 0xde
jmp 0x40bd93
mov eax, 0xda
jmp 0x40bd93
mov eax, 0xdc
jmp 0x40bd93
mov ebx, dword [ebp - 0x3c]
mov eax, 0xdd
jmp 0x40bd93
mov eax, 0xdf
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40bdc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x41c
mov eax, dword [0x43200c]
lea edi, [ebp - 0x424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x20a
push 0
push edi
call fcn.0040fdd0
add esp, 0xc
mov ecx, edi
call fcn.0040b4e0
xor esi, esi
test eax, eax
je 0x40be24
lea ebx, [ebp - 0x21a]
push 0x20a
push 0
push ebx
call fcn.0040fdd0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, str..status
push ebx
call fcn.0040b5c0
add esp, 4
test eax, eax
jne 0x40be3b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x41c
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
call fcn.0040c1f0
add esp, 8
test eax, eax
je 0x40be24
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40be24
mov edi, eax
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0040bec0
add esp, 0xc
push ebx
call fcn.004165e0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x428]
push 0
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
lea ecx, [ebp - 0x428]
setne al
cmp dword [ecx], esi
sete cl
and cl, al
movzx esi, cl
jmp 0x40be24

Function at 0x40bf10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x43200c]
mov esi, 0x102
xor eax, ebp
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], eax
je 0x40bfd7
mov ebx, dword [ebp + 8]
xor esi, esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x40bf91
mov edi, eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40bf9b
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.00414d91
add esp, 8
test eax, eax
je 0x40bfa5
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40bf65
mov ebx, 0x490
jmp 0x40bfa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x40bfae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x40bfa7
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x490
je 0x40bfd5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
mov ebx, dword [ebp + 8]
cmp esi, dword [ebp + 0xc]
jne 0x40bf3a
mov esi, 0x102
jmp 0x40bfd7
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40c040
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov eax, dword [0x43200c]
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x21a]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x20a
push 0
push edi
call fcn.0040fdd0
add esp, 0xc
push ebx
call fcn.00416709
add esp, 4
xor esi, esi
cmp eax, 0x104
ja 0x40c0ae
mov esi, dword [ebp + 0xc]
push 0x104
push ebx
push edi
call fcn.00416b82
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [esi], ecx
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40c130
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x254
mov eax, dword [0x43200c]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40c19c
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40c1d2
lea eax, [ebp - 0x22c]
push 0x105
push eax
push 0x43379c
call fcn.00416b82
add esp, 0xc
mov esi, 0x43379c
mov word [0x4339a4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040dec1
mov eax, esi
add esp, 0x254
pop esi
pop ebp
ret
lea ecx, [ebp - 0x258]
lea eax, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40c160
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00413fcc
cmp esi, 2
mov ecx, 9
cmove ecx, esi
xor esi, esi
mov dword [eax], ecx
jmp 0x40c187
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x12
je 0x40c187
call fcn.00413fcc
mov dword [eax], 2
jmp 0x40c187

Function at 0x41d389
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041d5d4

Function at 0x41fba9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041fbb4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3933408d
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x664b364d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x401f78
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x404230
call fcn.004020dc
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x405478
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x401d39
cmp eax, esi
jne 0x401d2c
xor esi, esi
inc esi
mov ebx, esi
jmp 0x401d3c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d13
xor esi, esi
inc esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401d4f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d7e
mov eax, dword [0x405474]
test eax, eax
jne 0x401d78
mov dword [0x405474], esi
push 0x4030e4
push 0x4030d8
call fcn.00401c82
pop ecx
pop ecx
test eax, eax
je 0x401d7e
jmp 0x401ea6
mov dword [0x40513c], esi
mov eax, dword [0x405474]
cmp eax, esi
jne 0x401da2
push 0x4030d4
push 0x4030cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x405474], 2
test ebx, ebx
jne 0x401dae
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40547c], 0
je 0x401dd2
push 0x40547c
call fcn.00402064
pop ecx
test eax, eax
je 0x401dd2
push 0
push 2
push 0
call dword [0x40547c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401e2e
test al, al
je 0x401dec
cmp dword [ebp - 0x1c], 0
jne 0x401e2e
mov al, byte [esi]
test al, al
je 0x401dfc
cmp al, 0x20
ja 0x401dfc
inc esi
mov dword [ebp - 0x20], esi
jmp 0x401dec
test byte [ebp - 0x3c], 1
je 0x401e08
movzx eax, word [ebp - 0x38]
jmp 0x401e0b
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x405138], eax
cmp dword [0x40512c], 0
jne 0x401e82
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x401e3d
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x401e50
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x401dd9
cmp dword [0x40513c], 0
jne 0x401e91
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x405138]
jmp 0x401eb2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00402121
ret
call fcn.0040220b
jmp 0x401cd9
Function at 0x408f09
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
push 0x401060
mov dword [ebp - 8], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
mov dword [ebp - 0x18], ebx
call fcn.0040a0c5
mov dword [ebp - 0x14], eax
test esi, esi
js 0x408f8c
mov ecx, dword [ebp - 8]
mov byte [ebp - 0xc], bl
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x408f51
push dword [ebp - 0xc]
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
call fcn.0040aa4a
add esp, 0xc
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x10]
push eax
call fcn.00408cef
pop ecx
xor ecx, ecx
inc ecx
cmp dword [eax], 3
jne 0x408f8f
jmp 0x408f91
mov ecx, dword [ebp - 0xc]
mov bl, 1
test cl, 1
je 0x408f9e
lea ecx, [ebp - 0x30]
call fcn.00409e49
mov ecx, edi
test bl, bl
je 0x408fab
push 0x406f8c
jmp 0x408fae
push dword [ebp - 8]
call fcn.00409d50
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b227
leave
ret

Function at 0x4091eb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0xa0], edi
call fcn.0040a0c5
mov dword [ebp - 0x9c], eax
cmp dword [ebx + 0x10], edi
je 0x4092aa
lea edx, [ebp - 0xa0]
mov ecx, ebx
call fcn.00408cbb
test al, al
je 0x4092aa
push 0x44
pop esi
push esi
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.0040d920
xor eax, eax
mov dword [ebp - 0x88], esi
lea edi, [ebp - 0x98]
add esp, 0xc
cmp dword [ebx + 0x14], 8
mov esi, 0x406f90
stosd dword es:[edi], eax
push 0xf
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
jb 0x40926b
mov ebx, dword [ebx]
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x88]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4092aa
push dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x98]
call esi
mov al, 1
jmp 0x4092ac
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b227
leave
ret
Function at 0x40987a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
lea ecx, [ebp - 0x6c]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ecx
push 0x20019
push ebx
movzx eax, al
push 0x406fd0
sub eax, 0x7fffffff
mov dword [ebp - 0x6c], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4098dc
push 0x406f8c
mov ecx, esi
call fcn.00409d50
cmp dword [ebp - 0x6c], ebx
je 0x409986
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409986
push edi
push 0x64
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], ebx
push ebx
push eax
call fcn.0040d920
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x406f78
push dword [ebp - 0x6c]
call ebx
test eax, eax
jne 0x40996a
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x40996a
cmp dword [ebp - 0x70], 1
jne 0x40996a
shr edi, 1
cmp edi, 0x32
jae 0x40996a
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0x406f78
push dword [ebp - 0x6c]
call ebx
mov edx, eax
lea ecx, [edi + edi]
xor eax, eax
cmp word [ebp + ecx - 0x6a], ax
je 0x40995b
lea eax, [edi + 1]
cmp eax, 0x32
jae 0x40995b
cmp ecx, 0x64
jae 0x409998
xor eax, eax
mov word [ebp + ecx - 0x68], ax
lea eax, [ebp - 0x68]
test edx, edx
je 0x409967
mov eax, 0x406f8c
push eax
jmp 0x40996f
push 0x406f8c
mov ecx, esi
call fcn.00409d50
cmp dword [ebp - 0x6c], 0
je 0x409985
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b227
leave
ret 8
call fcn.0040b359
int3
Function at 0x40aafb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x40757c
push 0x407598
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ab35
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409d50
push esi
lea ecx, [esp + 0x24]
call fcn.004092bb
lea ecx, [esp + 0x20]
call fcn.00409667
mov esi, eax
test esi, esi
jns 0x40ab89
lea ecx, [esp + 8]
call fcn.0040aa70
test al, al
je 0x40abd3
cmp esi, 0x80040b00
jne 0x40abd3
lea ecx, [esp + 0x20]
call fcn.00409723
mov esi, eax
test esi, esi
js 0x40abd3
mov esi, 0x80040b02
jmp 0x40abd3
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40ab98
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40abcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40abc4
jle 0x40abd3
movzx esi, si
or esi, 0x80070000
jmp 0x40abd3
mov esi, 0x80004005
jmp 0x40abd3
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.00409357
lea ecx, [esp + 8]
call fcn.00409e49
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b227
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40dca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040cd96
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
invalid
Function at 0x1000b2f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.1000a532
jb 0x1000b3c1
sti
push dword [ebp - 0x698]
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104

Function at 0x1000b3d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.1000a532
xchg ebp, eax
mov ah, 0xa9
stosd dword es:[edi], eax
and byte [ebp - 0x230], 0
push 0x40
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
Function at 0x40643e
Capabilities:
Create thread
Inject thread

Disassembly:
mov eax, dword [0x53da70]
mov dword [0x53db34], eax
mov edx, dword [0x53da78]
push dword [0x53e114]
call fcn.0040d320
lea ecx, [0x53db38]
pop edx
call fcn.00408000
push dword [0x53db38]
call fcn.00408380
mov ebx, eax
inc ebx
mov dword [0x53db3c], ebx
push dword [0x53db34]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x53db40], eax
cmp dword [0x53db40], 0
je 0x4065c4
push 4
push 0x1000
push dword [0x53db3c]
push 0
push dword [0x53db40]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x53db44], eax
cmp dword [0x53db44], 0
je 0x4065b9
push 0x53db48
push dword [0x53db3c]
push dword [0x53db38]
push dword [0x53db44]
push dword [0x53db40]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x53db48]
cmp ebx, dword [0x53db3c]
jl 0x40659d
push str.Kernel32.dll
push 0
call fcn.0040a149
and eax, eax
je 0x40659d
push 0x4183d1
push 0
call fcn.0040a186
mov dword [0x53db4c], eax
push 0
call fcn.0040a0da
cmp dword [0x53db4c], 0
je 0x40659d
push 0
push 0
push dword [0x53db44]
push dword [0x53db4c]
push 0
push 0
push dword [0x53db40]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x53db50], eax
cmp dword [0x53db50], 0
je 0x40659d
push 0xffffffff
push dword [0x53db50]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x53d9a4
push dword [0x53db50]
call sub.KERNEL32.dll_GetExitCodeThread
push 0x4000
push dword [0x53db3c]
push dword [0x53db44]
push dword [0x53db40]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x53db40]
call sub.KERNEL32.dll_CloseHandle
push dword [0x53da78]
call fcn.0040c82e
mov dword [0x53d9a4], eax
ret