joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103a452
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 8]
mov eax, dword [esi]
test eax, eax
je 0x103a474
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and dword [esi], 0
lea ebx, [edi + 4]
mov eax, dword [ebx]
test eax, eax
je 0x103a487
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and dword [ebx], 0
push esi
push 0
push 0
push 0x8003
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x103a4ce
push 0
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x103a4ce
push ebx
push 1
push dword [esi]
push 0x6801
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x103a4e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103a4e2
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x103a52f
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea esi, [ecx + 0xc]
mov eax, dword [esi]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x103a550
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], edi
push 0x40
push 0x18
mov ebx, 0x1008b68
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push esi
call edi
test eax, eax
jne 0x103a59d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x103a58c
push 0xf0000048
push 0x18
push ebx
push 0
push esi
call edi
test eax, eax
jne 0x103a59d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103a59a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x103a5aa
Capabilities:
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x14]
mov eax, dword [esi]
mov dword [ebp - 8], 1
test eax, eax
je 0x103a5d4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
and dword [esi], 0
lea ebx, [edi + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x103a5e7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and dword [ebx], 0
push esi
push 0
push 0
push 0x8004
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x103a644
push 0
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x103a644
push ebx
push 1
push dword [esi]
push 0x660e
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x103a644
push 0
lea eax, [ebp - 8]
push eax
push 4
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x103a65b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103a658
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x103a9f5
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp ebx, esi
jne 0x103aa3d
mov eax, 0x80004003
push eax
push 0x1008c90
mov dword [ebp - 8], eax
push 0x549
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x103ab62
cmp dword [ebp + 0xc], esi
je 0x103aa5e
push dword [ebp + 0xc]
call fcn.0103a66a
cmp eax, esi
mov dword [ebp - 8], eax
jge 0x103aa5e
push eax
push 0x1008c90
push 0x54c
jmp 0x103aa24
push edi
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
jne 0x103aa92
mov eax, 0x8007000e
push eax
push 0x1008c90
push 0x551
jmp 0x103aaf1
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0x10], esi
jbe 0x103aacd
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push edi
push esi
push 1
push esi
push dword [eax + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x103ab0a
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x103aaa9
add dword [ebp - 4], 2
push dword [ebp - 4]
push esi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [ebx], eax
cmp eax, esi
jne 0x103ab32
mov eax, 0x8007000e
push eax
push 0x1008c90
push 0x566
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
mov dword [ebp - 8], eax
call fcn.0102f8f0
jmp 0x103ab4e
push esi
push 0x1008c90
push 0x55e
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov dword [ebp - 8], 0x80004005
jmp 0x103ab4e
push dword [ebp - 4]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xfffffffe
push eax
push edi
push dword [ebx]
call sub.msvcrt.dll_memcpy
add esp, 0x18
cmp edi, esi
je 0x103ab61
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0x10
Function at 0x103aecc
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x208], edi
mov byte [ebp - 0x204], 0
call sub.msvcrt.dll_memset
add esp, 0xc
test edi, edi
je 0x103b002
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push esi
call edi
test eax, eax
je 0x103b002
push ebx
call edi
test eax, eax
je 0x103b002
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x210]
xor edi, edi
push esi
mov dword [eax], edi
call fcn.0103a4f4
cmp eax, edi
jl 0x103b007
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103af5d
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, ebx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, di
jne 0x103af72
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 4]
mov esi, 0x200
cmp eax, esi
ja 0x103b002
push eax
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x200]
add cl, cl
push ebx
push eax
mov byte [ebp - 0x204], cl
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x210]
push edi
push 1
push edi
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x103afe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x103b007
and eax, 0xffff
or eax, 0x80070000
jmp 0x103b007
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call fcn.0103ae3a
jmp 0x103b007
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102da5f
leave
ret 0xc
Function at 0x103b01d
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
test edi, edi
je 0x103b142
push dword [ebp + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
call esi
test eax, eax
je 0x103b142
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x103b142
push dword [ebp + 8]
and dword [edi], 0
mov ecx, ebx
call fcn.0103a66a
mov esi, eax
xor ecx, ecx
cmp esi, ecx
jl 0x103b156
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, cx
jne 0x103b077
mov edi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
sub eax, edx
sar eax, 1
lea esi, [eax + eax]
push esi
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 1
push ecx
push dword [ebx + 0x10]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x103b0c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x103b0b5
mov esi, eax
jmp 0x103b156
and eax, 0xffff
or eax, 0x80070000
jmp 0x103b0ae
push 0x104a890
push dword [ebp - 4]
call fcn.0102ddd1
pop ecx
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x103b0de
mov esi, 0x8007000e
jmp 0x103b147
push dword [ebp - 4]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
push dword [ebp - 8]
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memcpy
add esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 0
push 1
push 0
push dword [ebx + 0x10]
call edi
test eax, eax
jne 0x103b130
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103b13e
and eax, 0xffff
or eax, 0x80070000
jmp 0x103b13e
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.0103ae3a
mov esi, eax
jmp 0x103b147
mov esi, 0x80070057
cmp dword [ebp - 8], 0
je 0x103b156
push dword [ebp - 8]
call fcn.0102d44c
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x103b164
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x103b1a3
mov esi, 0x80004003
push esi
push 0x1008d00
push 0x382
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x103b30c
push dword [ebp + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
call esi
test eax, eax
je 0x103b1bb
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x103b1cd
mov esi, 0x80070057
push esi
push 0x1008d00
push 0x387
jmp 0x103b18a
push dword [ebp + 8]
and dword [ebx], 0
mov ecx, edi
call fcn.0103a66a
mov esi, eax
test esi, esi
jge 0x103b1ed
push esi
push 0x1008d00
push 0x390
jmp 0x103b18a
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x103b1f3
lea ecx, [ebp + 8]
push ecx
push 2
sub eax, edx
pop ecx
sar eax, 1
mul ecx
push edx
push eax
call fcn.0103a31f
mov esi, eax
test esi, esi
jge 0x103b227
push esi
push 0x1008d00
push 0x395
jmp 0x103b18a
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x10], eax
call fcn.0100aa12
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0103a351
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jge 0x103b27c
push esi
push 0x1008d00
push 0x3a2
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x103b2fc
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 4]
push 0
push 1
push 0
push dword [edi + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x103b2bc
push eax
push 0x1008d00
push 0x3aa
push 0x1008a98
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
mov esi, 0x80004005
jmp 0x103b2fc
mov edi, dword [ebp + 0x10]
add edi, 2
push edi
push 0
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [ebx], eax
test eax, eax
jne 0x103b2e3
mov esi, 0x8007000e
push esi
push 0x1008d00
push 0x3b1
jmp 0x103b263
push edi
push 0
push eax
call sub.msvcrt.dll_memset
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebx]
call sub.msvcrt.dll_memcpy
add esp, 0x18
cmp dword [ebp - 4], 0
je 0x103b30c
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x103df84
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x103dfa1
mov dword [ebp - 4], 0x80004003
jmp 0x103dfee
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x103dfb2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 8]
push edi
mov edi, dword [sym.imp.msvcrt.dll_free]
cmp eax, ebx
je 0x103dfd0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 8]
call edi
pop ecx
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x103dfde
push eax
call edi
pop ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], ebx
mov dword [esi], 0xfffffc18
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4

Function at 0x103dffc
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x103e067
cmp dword [ebp + 0x14], esi
je 0x103e067
cmp ebx, esi
je 0x103e067
cmp edi, esi
jbe 0x103e057
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x103e067
mov eax, dword [ebp - 4]
test eax, eax
je 0x103e050
add esi, eax
sub edi, eax
add ebx, eax
cmp esi, dword [ebp + 0x10]
jb 0x103e026
jmp 0x103e057
mov dword [ebp - 8], 0x80004005
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
jl 0x103e067
xor eax, eax
inc eax
jmp 0x103e069
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x103f7ee
Capabilities:
Delete file
Get file size

Disassembly:
push 0x24
mov eax, 0x1044d93
call fcn.0102da74
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
cmp dword [ebx + 0x238], esi
jne 0x103f849
mov eax, 0x80004003
push eax
push 0x10098b8
push 0x2d4
mov edi, eax
push 0x10096a8
push 0x10018c8
mov ecx, 0x104abe8
call fcn.0102f8f0
jmp 0x103f930
mov ecx, dword [ebx + 0x238]
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x103f861
mov edi, 0x8000ffff
jmp 0x103f930
mov ecx, dword [ebx + 0x23c]
mov esi, dword [ebx + 0x238]
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.01037008
mov edi, eax
test edi, edi
jl 0x103f930
cmp dword [ebp - 0x14], 0
je 0x103f930
cmp dword [esi + 0xc], 1
jne 0x103f857
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x103f8ba
mov eax, 0x80004003
push eax
push 0x10098b8
push 0x2f7
jmp 0x103f82e
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x103f8dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x103f8dd
mov edi, 0x80004005
jmp 0x103f930
mov ecx, dword [ebx + 0x23c]
and dword [ebp - 0x24], 0
lea eax, [ebx + 0x244]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x28], edi
call fcn.010330a4
push eax
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.0103ef15
mov edi, eax
test edi, edi
jge 0x103f91d
push edi
push 0x10098b8
push 0x308
jmp 0x103f830
push dword [esi + 0x2c]
push dword [esi + 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.010423bf
mov edi, eax
cmp dword [ebp - 0x10], 0
je 0x103f943
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [ebp - 0x10], 0
test esi, esi
je 0x103f963
mov eax, dword [esi + 0x28]
test eax, eax
je 0x103f963
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x28]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 0x28], 0
pop ecx
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x103f974
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.0102db60
ret

Function at 0x1040997
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10409f4
cmp dword [ebp + 8], 0
je 0x10409f4
cmp dword [ebp + 0x10], 1
mov dword [esi + 0x10], 8
jne 0x10409c6
mov eax, dword [esi + 4]
test eax, eax
je 0x10409c6
push eax
push dword [esi]
call fcn.01042426
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10409d8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0xc], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x10409f4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 8]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 8], 0
pop ecx
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1042224
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x104a328]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
test eax, eax
jne 0x1042299
mov ebx, 0x80004003
jmp 0x10423a9
test ecx, ecx
jne 0x10422a7
mov ebx, 0x80070006
jmp 0x10423a9
push esi
mov esi, dword [sym.imp.msvcrt.dll_calloc]
push edi
push 1
mov ebx, 0x19001
push ebx
call esi
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x10422cb
mov ebx, 0x8007000e
jmp 0x104238d
mov byte [eax], 0
inc eax
dec ebx
jne 0x10422cb
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x19000
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10422f4
mov ebx, 0x80004005
jmp 0x104238d
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1042303
xor ebx, ebx
inc ebx
jmp 0x104238d
mov byte [edi + eax], 0
mov eax, dword [ebp - 0x18]
lea eax, [eax*4 + 1]
push 1
push eax
call esi
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x10422c1
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
jbe 0x1042352
movzx edx, byte [ecx + edi]
shr edx, 4
mov dl, byte [ebp + edx - 0x14]
mov byte [eax], dl
inc eax
mov byte [eax], 0
movzx edx, byte [ecx + edi]
and edx, 0xf
mov dl, byte [ebp + edx - 0x14]
inc eax
mov byte [eax], dl
inc eax
mov byte [eax], 0
inc eax
inc ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1042328
mov eax, dword [ebp - 0x18]
shl eax, 2
push eax
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
test esi, esi
jne 0x1042370
mov ebx, 0x8007000e
jmp 0x1042382
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x24]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x1c]
mov ebx, eax
test esi, esi
je 0x104238d
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [sym.imp.msvcrt.dll_free]
test edi, edi
je 0x104239b
push edi
call esi
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x10423a7
push dword [ebp - 0x1c]
call esi
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0102da5f
leave
ret 0x10
Function at 0x10424b1
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x10424de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1042572
push edi
push 0x14
push 0x1009d28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x10424fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1042554
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x104251a
call esi
mov ebx, eax
cmp ebx, 0x420
jne 0x104255f
mov ebx, 0x5b4
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1042552
cmp dword [ebp - 0x20], 4
je 0x1042558
cmp dword [ebp - 0x20], 1
je 0x104255c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jbe 0x104251f
jmp 0x104255f
call esi
mov ebx, eax
jmp 0x104255f
xor ebx, ebx
jmp 0x104255f
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x104256c
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10428de
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [esi], edi
call fcn.01042825
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x1042a0a
mov eax, dword [ebp - 0xc]
push 3
pop ecx
cmp eax, ecx
jb 0x1042914
add eax, 0xfffffff0
sub eax, edi
je 0x1042a08
dec eax
je 0x1042938
dec eax
je 0x104292e
mov dword [ebp + 8], 0xc00000bb
jmp 0x1042a0a
mov dword [ebp - 0xc], ecx
mov eax, 0x100a404
jmp 0x1042944
mov dword [ebp - 0xc], 5
mov eax, 0x100a3cc
push 4
pop ebx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push edi
push 0x10
push eax
mov edi, 0x1004a60
push edi
mov esi, 0x80000002
push esi
mov dword [ebp - 4], ebx
call sub.ADVAPI32.dll_RegGetValueW
test eax, eax
jne 0x10429b3
mov eax, dword [ebp - 8]
cmp eax, 6
jae 0x1042976
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x10429a8
cmp dword [ebp - 0xc], 1
je 0x10429a8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10
push 0x100a3a0
push edi
push esi
mov dword [ebp - 4], ebx
call sub.ADVAPI32.dll_RegGetValueW
xor edi, edi
cmp eax, edi
jne 0x10429be
cmp dword [ebp - 8], edi
je 0x10429c7
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x1042a0a
cmp eax, 2
je 0x1042976
test eax, eax
jg 0x10429f9
jmp 0x1042a03
cmp eax, 2
je 0x10429c7
cmp eax, edi
jmp 0x10429ba
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x10
push 0x100a360
push 0x100a2e8
push esi
mov dword [ebp - 4], ebx
call sub.ADVAPI32.dll_RegGetValueW
cmp eax, edi
jne 0x10429f0
cmp dword [ebp - 8], edi
je 0x1042a0a
jmp 0x10429a8
cmp eax, 2
je 0x1042a0a
cmp eax, edi
jle 0x1042a03
and eax, 0xffff
or eax, 0xc0070000
mov dword [ebp + 8], eax
jmp 0x1042a0a
mov dword [esi], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8