joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558890
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5ee760
call fcn.0040e5e0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00558880
push ebp
push 0x413c60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408980
mov edx, dword [ebp - 0xc]
mov eax, fcn.004dcca0
mov dword [edx + 0x2c], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.004092d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408980
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x18]
push eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x14]
push eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00556680
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00558f30
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x5589a3
jmp 0x5589c4
mov eax, dword [ebp - 4]
call fcn.004fe5b0
test al, al
je 0x5589b1
jmp 0x5589c4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
mov esi, esi
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00558880
mov esp, ebp
pop ebp
ret
Function at 0x57d6e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, eax
mov ebx, edx
mov eax, esi
xor cl, cl
mov edx, 0x78
call fcn.004035c0
mov dword [esi], ebx
mov eax, ebx
test ebx, ebx
je 0x57d768
sub eax, 1
jb 0x57d778
sub eax, 1
ja 0x57d778
mov esi, esi
cmp ebx, 1
jne 0x57d71f
mov eax, 0x57d120
mov dword [esi + 4], eax
jmp 0x57d727
mov eax, 0x57c9a0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x40
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
jmp 0x57d778
mov dword [esi + 8], 0x10
mov eax, 0x57d020
mov dword [esi + 4], eax
nop
pop esi
pop ebx
ret
Function at 0x6d6a61f6
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0x80
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d6a6268
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.identifier
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d6a6268
push str.ia64
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jne 0x6d6a6268
xor esi, esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.6d6a886c
add ebp, 0x78
leave
ret

Function at 0x6d6a886c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d6e05c8]
jne 0x6d6a8876
repz ret
jmp fcn.6d6afa4c

Function at 0x6d6aa5f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x6d6aa605
pop dword [ebp - 0x1c]
mov eax, 0x26b48ede
sub eax, 0xb949e8d9
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x43796
push 0
mov eax, 0x4fe74861
sub eax, 0xe27a2661
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x529dfed
add ecx, 0xfad66786
xor edx, edx
add edx, eax
mov esi, 0x30e5ebd0
add esi, 0x3c8ce430
add esi, dword [ebp - 0x1c]
mov ebx, 0x6c1c601
mov edi, dword [esi]
xor dword [ebp - 8], ecx
add edi, ebx
xor dword [ebp - 0x10], 0x693d62c8
mov dword [edx], edi
xor dword [ebp - 8], edi
add edx, 0x2c1acdbc
add edx, 0xd3e53248
add esi, 0xb172696a
add esi, 0x4e8d969a
loop 0x6d6aa660
add eax, 0x127e9389
sub eax, 0x127d82ea
xor ebx, ebx
add ebx, eax
add eax, 0x228fcda2
sub eax, 0x228fcd9d
mov ecx, 0xf50abda5
sub ecx, 0x87a1bda5
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x6d6cee03
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d6e7248], 0
push esi
push edi
jne 0x6d6ced74
call fcn.6d6cecce
test eax, eax
je 0x6d6cedb9
mov eax, dword [0x6d6e7248]
cmp eax, 1
jne 0x6d6ced95
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d6cedb9
jmp 0x6d6cedfb
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d6cedfb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d6cedbd
xor eax, eax
jmp 0x6d6cedfb
mov eax, dword [esi]
push dword [0x6d6e7248]
call edi
mov edi, eax
test edi, edi
je 0x6d6ceddf
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d6cedfb
lea edi, [esi + 0xff0]
push esi
push dword [0x6d6e7248]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d6cede5
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d6ced60
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a34dc62
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a34dc62
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a34dc62
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a34dc62
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a34dc62
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a34dc62
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a34dc62
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a34dc62
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a34dc62
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a34dc62
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a34dc62
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a34dc62
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x2a34dc62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2a34dc71
pop dword [ebp - 8]
mov eax, 0x2a34dc71
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xba236fe9
add dword [ebp - 0x18], 0x942ed562
mov dword [ebp - 0x14], 0xb3fd0f37
add dword [ebp - 0x14], 0x7e363d0e
mov dword [ebp - 0x10], 0x92c7c01c
sub dword [ebp - 0x10], 0x467b7bee
mov dword [ebp - 0xc], 0x27ab42a9
sub dword [ebp - 0xc], 0x27ab42a9
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x568af885
add dword [ebp - 0x18], 0x1de770d1
mov dword [ebp - 0x14], 0x790f9746
sub dword [ebp - 0x14], 0x37a335d1
mov dword [ebp - 0x10], 0xdff6dd94
add dword [ebp - 0x10], 0x83788ed8
mov dword [ebp - 0xc], 0x6b12f0e8
add dword [ebp - 0xc], 0x94ed0f18
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x4665d
push 0
call eax
mov ecx, 0x7b10409b
add ecx, 0x84eff758
xor ebx, ebx
add ebx, eax
mov esi, 0x2a37f600
add esi, dword [ebp - 8]
mov edi, 0x50247bd8
sub edi, 0x1f357331
xor dword [ebp - 4], edi
mov edx, dword [esi]
add edx, edi
mov dword [ebx], edx
mov dword [ebp - 4], 0x15d83353
add ebx, 0xee96413b
add ebx, 0x1169bec9
add esi, 0x26431482
sub esi, 0x2643147e
loop 0x2a34dd80
add eax, 0xd29f
mov ebx, eax
add eax, 5
mov ecx, 0x45b98857
add ecx, 0xe47677a9
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401097
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push edi
mov esi, 0x201
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x70]
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x71], bl
call fcn.0040d0d0
push esi
lea eax, [ebp + 0x194]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.0040d0d0
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
push str._s_sProperties
push eax
mov dword [ebp - 0x7c], 0x200
call fcn.0040d39b
add esp, 0x28
lea eax, [ebp - 0x78]
push eax
mov eax, dword [edi]
or eax, 0x20019
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40112a
xor al, al
jmp 0x401195
push esi
lea eax, [ebp + 0x194]
push ebx
push eax
call fcn.0040d0d0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push ebx
push ebx
push str.b3f8fa53_0004_438e_9003_51a46e139bfc_6
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401189
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x401189
push eax
call fcn.0040d310
push eax
push dword [edi + 4]
lea eax, [ebp + 0x194]
push eax
call fcn.0040d2a6
add esp, 0x10
test eax, eax
jne 0x401189
mov byte [ebp - 0x71], 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d418
add ebp, 0x39c
leave
ret 4

Function at 0x4011af
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x19c]
push 0x201
xor ebx, ebx
lea eax, [ebp - 0x74]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x75], 1
call fcn.0040d0d0
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
lea eax, [ebp - 0x74]
push str._s_s
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call fcn.0040d39b
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [esi]
or eax, 0x1b
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401255
mov eax, dword [ebp + 0x1a0]
push 4
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 4
push ebx
push str.DeviceState
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40124c
mov byte [ebp - 0x75], bl
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x190]
mov al, byte [ebp - 0x75]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d418
add ebp, 0x194
leave
ret 8
Function at 0x401317
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
mov esi, dword [ebp + 0x1a4]
push edi
push 0x201
mov dword [ebp - 0x7c], eax
xor ebx, ebx
lea eax, [ebp - 0x70]
push ebx
push eax
mov edi, ecx
call fcn.0040d0d0
add esp, 0xc
push dword [ebp - 0x7c]
mov ecx, edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call fcn.00401097
push dword [ebp - 0x7c]
mov byte [esi + 0x200], al
push str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
lea eax, [ebp - 0x70]
push str._s_s
push eax
call fcn.0040d39b
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
mov eax, dword [edi]
or eax, 0x20019
push eax
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4013b0
xor al, al
jmp 0x4013f9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push str.DeviceState
push dword [ebp - 0x74]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4013e8
mov eax, dword [ebp - 0x78]
mov byte [esi + 0x201], 1
mov dword [esi + 0x204], eax
jmp 0x4013ee
mov byte [esi + 0x201], bl
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d418
add ebp, 0x198
leave
ret 8
Function at 0x401457
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
push edi
mov esi, 0x200
xor ebx, ebx
push esi
lea eax, [ebp + 0x19c]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x70], ebx
call fcn.0040d0d0
push 0x208
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x74], esi
call fcn.0040d0d0
push 0x20a08
lea eax, [edi + 0xc]
push ebx
push eax
mov byte [edi + 8], bl
call fcn.0040d0d0
add esp, 0x24
lea eax, [ebp - 0x70]
push eax
mov eax, dword [edi]
or eax, 0x20019
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudioRender
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4014de
xor al, al
jmp 0x4015c7
push esi
lea eax, [ebp + 0x19c]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], esi
call fcn.0040d0d0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x19c]
push eax
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4015bc
lea eax, [edi + 0xc]
mov dword [ebp - 0x78], eax
push 0x208
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040d0d0
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0040dc40
add esp, 0x14
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x19c]
push eax
mov ecx, edi
call fcn.00401317
test al, al
je 0x401582
cmp dword [ebp - 0x7c], 0x100
jge 0x401582
push 0x208
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x78]
mov byte [edi + 8], 1
call fcn.0040d8d0
add esp, 0xc
inc dword [ebp - 0x7c]
add dword [ebp - 0x78], 0x208
inc dword [ebp - 0x80]
push esi
lea eax, [ebp + 0x19c]
push ebx
push eax
mov dword [ebp - 0x74], esi
call fcn.0040d0d0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x19c]
push eax
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40151f
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp + 0x39c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d418
add ebp, 0x3a0
leave
ret
Function at 0x40179f
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x425630]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
mov ebx, ecx
call fcn.00401761
test eax, eax
je 0x4017ce
xor eax, eax
inc eax
jmp 0x40188e
push esi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x80], eax
cmp eax, esi
jne 0x4017fd
push esi
add ebx, 0x34
push ebx
push 0x41e5f8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40188d
push edi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push str.RPCSS
push esi
push esi
lea eax, [ebp - 0x7c]
push eax
push 1
push 2
push 0x110
push 0xf01ff
add ebx, 0x34
push ebx
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
cmp edi, esi
jne 0x40184f
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push ebx
push 0x41e5d0
jmp 0x401871
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push edi
test eax, eax
jne 0x40187c
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push dword [ebp - 0x80]
call edi
push esi
push ebx
push 0x41e5b0
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40188c
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x80]
call esi
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
pop ebx
call fcn.0040d418
add ebp, 0x8c
leave
ret

Function at 0x4018a4
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x20
push ebp
mov ebp, ecx
call fcn.00401761
test eax, eax
jne 0x4018b9
inc eax
jmp 0x40195b
push esi
push edi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, esi
jne 0x4018e5
push esi
add ebp, 0x34
push ebp
push 0x41e5f8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401959
push ebx
push 0x10020
lea ebx, [ebp + 0x34]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40190d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push ebx
push 0x41e640
push esi
jmp 0x401950
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x14], eax
call esi
push edi
call esi
xor eax, eax
cmp dword [esp + 0x10], eax
je 0x401948
push 1
mov ecx, ebp
call fcn.00408a3e
xor eax, eax
inc eax
jmp 0x401958
push eax
push ebx
push 0x41e620
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret