joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f77b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dd67
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x54a2f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
push 0x34
call fcn.004259cd
mov ebx, eax
add esp, 4
lea edi, [ebx + 0x14]
mov dword [ebp - 0x1c], ebx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebx + 0x10], esi
mov esi, ecx
mov dword [ebx + 8], 0
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4f7820
sub esi, edx
mov edx, dword [edi + 0x14]
mov dword [ebp - 0x1c], edx
cmp esi, edx
ja 0x4f785c
mov dword [ebp - 0x14], edi
mov eax, edi
cmp edx, 0x10
jb 0x4f7842
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
push esi
push ecx
push eax
mov dword [edi + 0x10], esi
call fcn.004318e0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x4f793f
cmp esi, 0x7fffffff
ja 0x4f799d
mov ecx, esi
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x4f787c
mov ecx, 0x7fffffff
jmp 0x4f78a0
mov eax, edx
shr eax, 1
mov dword [ebp - 0x14], eax
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x14]
cmp edx, eax
jbe 0x4f7896
mov ecx, 0x7fffffff
jmp 0x4f78a0
mov eax, dword [ebp - 0x14]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea edx, [ecx + 1]
mov dword [ebp - 0x10], ecx
cmp edx, 0x1000
jb 0x4f78da
lea eax, [edx + 0x23]
or ecx, 0xffffffff
cmp eax, edx
cmovbe eax, ecx
push eax
call fcn.004259cd
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4f79a2
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0x10]
jmp 0x4f78ee
test edx, edx
je 0x4f78ec
push edx
call fcn.004259cd
mov ecx, dword [ebp - 0x10]
add esp, 4
jmp 0x4f78ee
xor eax, eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push eax
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], ecx
call fcn.004310c0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
mov byte [eax + esi], 0
cmp ecx, 0x10
jb 0x4f793d
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x4f7930
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f79a2
mov eax, edx
push ecx
push eax
call fcn.004259fd
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x4f6e30
mov dword [ebx + 0x30], eax
call fcn.0043729b
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f797f
push 0
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, ebx
call fcn.00405000
xor ebx, ebx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00405120
call fcn.00438049
int3
Function at 0x4f7ab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.004259cd
mov ebx, eax
mov eax, dword [ebp + 8]
push ebx
push 0
push 0x4f6ed0
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
call fcn.0043729b
add esp, 0x10
cmp eax, 0xffffffff
je 0x4f7b04
push 2
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
push 0x18
push ebx
call fcn.004259fd
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f7bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.004259cd
mov ebx, eax
mov eax, dword [ebp + 8]
push ebx
push 0
push 0x4f6fa0
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
call fcn.0043729b
add esp, 0x10
cmp eax, 0xffffffff
je 0x4f7c14
push 2
push eax
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
push 0x18
push ebx
call fcn.004259fd
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f8330
Capabilities:
Change the wallpaper
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x54a2f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
mov esi, edx
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.control_paneldesktop
push 0x80000001
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
test esi, esi
mov ecx, 0x5348f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, 0x5348f8
cmove eax, ecx
push eax
push 1
push 0
push 0x534900
push dword [ebp - 0x620]
call esi
push 4
test edi, edi
mov ecx, 0x5348f4
mov eax, 0x5348fc
cmove eax, ecx
push eax
push 1
push 0
push str.TileWallpaper
push dword [ebp - 0x620]
call esi
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004f34d0
add esp, 8
lea eax, [ebp - 0x61c]
push 3
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004259b7
mov esp, ebp
pop ebp
ret
Function at 0x4f8bf0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x562dc4]
push esi
mov esi, ecx
test eax, eax
je 0x4f8c93
test esi, esi
je 0x4f8c63
call fcn.004b7d30
test eax, eax
jne 0x4f8c57
cmp dword [0x5ad314], eax
je 0x4f8c3d
push 0x25
push eax
push eax
push dword [0x5ad2f0]
push dword [0x5ad2ec]
push eax
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x5ad2f0]
call fcn.004bc020
push 1
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x5ad314], 0
jmp 0x4f8c71
push 0
push dword [0x562aa0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5ad2e4], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x562aa0]
mov eax, dword [0x562dc4]
sete cl
mov dword [0x562938], ecx
pop esi
ret

Function at 0x4fa2f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x34], 0xffffffff
jne 0x4fa307
mov eax, 0x80070006
pop esi
pop ebp
ret 0x10
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ecx, dword [esi + 0x44]
push ebx
mov ebx, edx
add ebx, dword [esi + 0x38]
mov dword [ebp + 8], ebx
adc eax, dword [esi + 0x3c]
mov ebx, dword [esi + 0x40]
add ebx, dword [esi + 0x48]
adc ecx, dword [esi + 0x4c]
cmp eax, ecx
jb 0x4fa338
ja 0x4fa32f
cmp dword [ebp + 8], ebx
jbe 0x4fa338
mov edx, dword [esi + 0x40]
sub edx, dword [esi + 0x38]
add edx, dword [esi + 0x48]
mov ebx, dword [ebp + 0x14]
push 0
push ebx
push edx
push dword [ebp + 0xc]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4fa367
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4fa372
movzx eax, ax
pop ebx
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
mov eax, dword [ebx]
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], 0
xor eax, eax
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x500720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor cl, cl
mov dword [ebp - 0x10], esi
xor bl, bl
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x5007f9
cmp esi, 0x20
jb 0x5007f9
mov ecx, esi
xorps xmm2, xmm2
and ecx, 0xffffffe0
xorps xmm4, xmm4
xorps xmm3, xmm3
xorps xmm5, xmm5
nop
movups xmm1, xmmword [edi + eax]
movaps xmm0, xmm1
pxor xmm5, xmm1
movups xmm1, xmmword [edi + eax + 0x10]
add eax, 0x20
paddb xmm2, xmm0
movaps xmm0, xmm1
pxor xmm3, xmm1
paddb xmm4, xmm0
cmp eax, ecx
jb 0x500760
pxor xmm3, xmm5
paddb xmm4, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 2
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 1
pxor xmm3, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddb xmm4, xmm0
movd ebx, xmm3
movups xmm0, xmm4
psrldq xmm0, 4
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 2
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 1
paddb xmm4, xmm0
movd ecx, xmm4
mov dword [ebp - 8], ecx
xor dh, dh
mov byte [ebp - 1], 0
cmp eax, esi
jae 0x500844
mov ecx, esi
sub ecx, eax
cmp ecx, 2
mov ch, byte [ebp - 1]
jb 0x500831
lea edi, [esi - 1]
mov esi, dword [ebp - 0xc]
mov dl, byte [esi + eax]
mov cl, byte [esi + eax + 1]
add ch, dl
xor dl, cl
add eax, 2
add dh, cl
xor bl, dl
cmp eax, edi
jb 0x500815
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
cmp eax, esi
jae 0x50083d
mov al, byte [eax + edi]
add byte [ebp - 8], al
xor bl, al
add dh, ch
mov ecx, dword [ebp - 8]
add cl, dh
cmp byte [ebp + 8], cl
jne 0x50085a
cmp byte [ebp + 0xc], bl
jne 0x50085a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x500870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
xor cl, cl
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x50094b
cmp esi, 0x20
jb 0x50094b
mov edx, dword [ebp + 8]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm2, xmm2
xorps xmm4, xmm4
xorps xmm3, xmm3
xorps xmm5, xmm5
movups xmm1, xmmword [edx + eax]
movaps xmm0, xmm1
pxor xmm5, xmm1
movups xmm1, xmmword [edx + eax + 0x10]
add eax, 0x20
paddb xmm2, xmm0
movaps xmm0, xmm1
pxor xmm3, xmm1
paddb xmm4, xmm0
cmp eax, ecx
jb 0x5008b2
pxor xmm3, xmm5
paddb xmm4, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 2
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 1
pxor xmm3, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddb xmm4, xmm0
movd ebx, xmm3
movups xmm0, xmm4
psrldq xmm0, 4
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 2
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 1
paddb xmm4, xmm0
movd ecx, xmm4
mov dword [ebp - 8], ecx
xor dh, dh
mov byte [ebp - 1], 0
cmp eax, esi
jae 0x5009a7
mov ecx, esi
sub ecx, eax
cmp ecx, 2
mov ch, byte [ebp - 1]
jb 0x500983
lea edi, [esi - 1]
mov esi, dword [ebp + 8]
mov dl, byte [esi + eax]
mov cl, byte [esi + eax + 1]
add ch, dl
xor dl, cl
add eax, 2
add dh, cl
xor bl, dl
cmp eax, edi
jb 0x500967
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
cmp eax, esi
jae 0x500992
mov esi, dword [ebp + 8]
mov al, byte [eax + esi]
add byte [ebp - 8], al
xor bl, al
mov eax, dword [ebp - 8]
add dh, ch
add al, dh
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov byte [edi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov byte [edx], cl
mov byte [edi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x502d70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e0b5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x54a2f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00503520
mov dword [ebp - 4], 0
lea ecx, [esi + 0x98]
mov dword [esi], vtable.YCMFPlayer.1.0
mov dword [esi + 8], vtable.YCMFPlayer.0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0x3f800000
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x3f800000
mov dword [esi + 0x88], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
call fcn.004a06d0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov word [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], 0
mov dword [esi + 0x58], 0x80
mov byte [esi + 0x5c], 0
mov dword [esi + 0x60], 0x3f800000
mov dword [esi + 0x64], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040486c
xor eax, eax
push ebp
push 0x406760
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004043bc
mov eax, dword [ebp - 4]
call fcn.0040467c
mov ebx, eax
test bx, bx
jbe 0x406742
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0xc
call fcn.004045a4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404684
inc edi
dec bx
jne 0x406713
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406767
lea eax, [ebp - 0xc]
call fcn.004043bc
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x40141c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40142e
mov eax, dword [0x48a08b]
shl eax, 2
mov dword [0x48a08f], eax
push edx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
call fcn.0047e364
pop edx
call fcn.0047e2c8
call fcn.0047e3a4
push 0
call fcn.0047f828
pop ecx
push 0x48a034
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x48a093], eax
push 0
jmp fcn.004849c0
Function at 0x401ea8
Capabilities:
Unmount volume via ioctl

Disassembly:
fsub dword [ecx + ecx*4 + 0x15]
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x401e8c
call fcn.00488f61
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
add esp, 0xfffffef0
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.0040215a
dec edx
dec edx
pop edx
jp 0x401e76
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x401f11
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x21d174c]
invalid
mov bh, 0x72
or byte [eax], al
sub ebx, edi
lea esi, [esi + ebx]
sbb ebx, 0xffffffdd
xor ebx, dword [esp + 8]
mov ebx, dword [esi]
and ebx, 0xff
sub esi, 0xffffffd1
rol esi, 0x4d
push 0x7fde075a
and esi, ebp
pop esi
lea ebx, [ebx - 0x7fde0842]
lea ebx, [ebx + esi]
test ebx, ebx
je 0x401f6c
xor ebp, dword [esp + 0x28]
mov ebp, 0x410562
sbb esi, 0xa6e0d1e6
sbb edi, 0xffffffdf
add edi, dword [esp + 0x18]
push dword [esp + 0x14]
jmp 0x401f6c
pop ebx
pop esi
jmp 0x402002
mov eax, dword [0x48a548]
mov dword [ebp - 8], eax
mov ax, word [0x48a54c]
mov word [ebp - 4], ax
mov al, byte [0x48a54e]
mov byte [ebp - 2], al
mov dl, byte [ebp + 0x10]
mov byte [ebp - 4], dl
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 8]
push ecx
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x402051
or eax, 0xffffffff
jmp 0x4021e7
cmp byte [ebp + 0x14], 0
je 0x402070
push dword [ebp + 8]
push 0x48e2f4
lea edx, [ebp - 0x110]
push edx
call fcn.00480484
add esp, 0xc
jmp 0x402087
push dword [ebp + 8]
push 0x48e312
lea ecx, [ebp - 0x110]
push ecx
call fcn.00480484
add esp, 0xc
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_DeleteVolumeMountPointA
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 4]
push ecx
push 1
call sub.kernel32.dll_DefineDosDeviceA
test eax, eax
jne 0x4020b8
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffe
jmp 0x4021e7
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 8]
push edx
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402104
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
lea ecx, [ebp - 4]
push ecx
call sub.kernel32.dll_DeleteVolumeMountPointA
push 0
lea eax, [ebp - 4]
push eax
push 2
call sub.kernel32.dll_DefineDosDeviceA
mov eax, 0xfffffffd
jmp 0x4021e7
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x12]
add eax, 0x18
dec eax
push eax
push dword [ebp + 0xc]
push 0x8000e000
push dword [ebp - 0xc]
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x40214d
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
push 0
lea edx, [ebp - 4]
push edx
push 2
call sub.kernel32.dll_DefineDosDeviceA
mov eax, 0xfffffffc
jmp 0x4021e7
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
jmp 0x4021ae
jmp 0x4021e5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40215a
Capabilities:
Unmount volume via ioctl

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x401ef2
push 1
call fcn.00483c58
pop ecx
push esi
push ebx
jmp 0x401f6c
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x270]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x402183
pop esi
cmp edi, 0xa0ab39a3
pop ebp
pop edi
nop
jmp 0x401ee1

Function at 0x4021ec
Capabilities:
Unmount volume via ioctl

Disassembly:
test al, 0x7e
aad 0xbf
push 0x11
pop edx
xor eax, 0x96adddb
or byte [edi - 0x3efc2e87], bl
in al, dx
nop
pop esi
jge 0x40220e
push esi
mov al, byte [esi + 7]
jb 0x402189
pop es
lea ebx, [ebp + 0x1e9ccb9a]
and edi, dword [esi - 0x7f]
sbb dh, ah
and byte [eax - 0x3fcc8e62], 0x8b
in eax, 0x5d
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.00402484
dec edx
dec edx
pop edx
jp 0x4021b7
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x402252
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0x55e174c]
invalid
sub ecx, edx
lea ecx, [ecx + eax - 0x20]
sub ecx, eax
push dword [ecx]
ror ecx, 0xc1
xor ecx, dword [esp + 0x28]
pop ecx
add edx, ecx
push 0x87438
mov edx, 0x48abce
add edx, dword [esp + 0x18]
pop edx
lea ecx, [ecx + edx*2 + 0x65]
lea ecx, [ecx + ebp - 0x65]
sub ecx, ebp
sub ecx, edx
lea edx, [ebx + ecx + 0x5a]
sub edx, ecx
push dword [ecx]
mov edx, 0x4721a6
add edx, dword [esp + 0x38]
pop edx
and edx, 0xff
or ecx, 0xfffffff1
xor ecx, dword [esp + 0x28]
rcr ecx, 0xbb
mov ecx, 0x440f2e
lea ecx, [edx + 0x29fd8925]
sub ecx, edx
lea edx, [edx + eax - 0x29fd8a0d]
sub edx, eax
lea edx, [edx + ecx]
test edx, edx
je 0x4022e9
add ebp, dword [esp + 0x38]
ror ebp, 0x9b
and esi, 0x80414d58
mov edi, 0x4a2cf2
xor edi, dword [esp + 0x28]
push dword [esp + 0x18]
jmp 0x4022e9

Function at 0x402484
Capabilities:
Unmount volume via ioctl

Disassembly:
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x259]
sub ebp, ecx
Function at 0x402af2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
call fcn.00401cc8
test eax, eax
jne 0x402831
push 1
call fcn.00483c58
pop ecx
push esi
push ebx
jmp 0x4028ba
lea esi, [ecx + edx - 7]
pop ebp
lea ebp, [ebp + edi + 0x24]
sub ebp, edi
lea esi, [edi + eax*2 + 0x3d]
lea esi, [ecx + edx - 0x19]
sub esi, edx
lea esi, [ebp + 0x7a]
lea esi, [esi - 0x7a]
lea ebp, [ebp + ecx + 0x2c9]
sub ebp, ecx
sub edi, dword [esi]
lea esi, [esi + eax + 1]
sub esi, eax
cmp esi, ebp
jb 0x402b1b
pop esi
cmp edi, 0x63773ba1
pop ebp
pop edi
nop
jmp 0x402820

Function at 0x402ba0
Capabilities:
Create service

Disassembly:
lcall 0x817e, 0x231e9ccb
sbb dh, ah
and byte [eax + 0x1b0719e], 0x50
push ebp
mov ebp, esp
add esp, 0xfffffee4
push esi
push edi
push edi
push ebp
push esi
or edi, 0xffffffff
inc edi
call fcn.00402dcc
dec edx
dec edx
pop edx
jp 0x402b70
cld
sti
xchg ebp, eax
arpl dx, sp
test dword [edi + 0x4c], esp
lodsb al, byte [esi]
mov dl, dh
pop edi
sbb al, 0xd4
dec edi
shl ebx, 1
pop ds
shl byte [ecx + edx*4 - 0x55], 0xfb
dec edi
jns 0x402c0b
stosd dword es:[edi], eax
popfd
or bl, byte [ebp - 0xf17174c]
invalid
pushfd
fild word [eax + eax - 0x73]
pop esp
push ecx
pop edi
lea ebx, [ebp + 0x86555]
sub ebx, ebp
lea esi, [esi + ebx]
rcl ebx, 0xd5
or ebx, 0x11
mov ebx, dword [esi]
and ebx, 0xff
xor esi, dword [esp + 8]
mov esi, 0x4abe8a
sub esi, 0xcfc357f6
rcl esi, 0xcb
mov esi, 0x49e14e
lea esi, [ecx + edx - 0x3778aa7e]
sub esi, edx
sub esi, ecx
lea ebx, [ebx + eax + 0x3778a996]
sub ebx, eax
lea ebx, [ebx + esi]
test ebx, ebx
je 0x402c83
add ebp, dword [esp + 0x38]
add ebp, dword [esp + 0x18]
add esi, edi
xor edi, dword [esp + 8]
sbb edi, 5
push dword [esp + 0x24]
jmp 0x402c83
pop ebx
pop esi
jmp 0x402cfc
mov dword [ebp - 0x18], 0x100
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402d29
push dword [ebp - 8]
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
jmp 0x402e59
mov esi, 0x48a55d
lea edi, [ebp - 0x11c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 0x10]
push 0x48e365
lea eax, [ebp - 0x11c]
push eax
call fcn.00480484
add esp, 0xc
push 0
push 0
push 0
push 0
push dword [ebp + 0x14]
lea edx, [ebp - 0x11c]
push edx
push 1
push 3
push 1
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402db7
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3e5
je 0x402db7
cmp dword [ebp - 0x18], 0x431
je 0x402db7
push dword [ebp - 0xc]
call sub.advapi32.dll_CloseServiceHandle
push dword [ebp - 8]
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
jmp 0x402e59
push dword [ebp - 0xc]
call sub.advapi32.dll_CloseServiceHandle
push dword [ebp - 8]
call sub.advapi32.dll_CloseServiceHandle
jmp 0x402e20
jmp 0x402e57
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret