joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401510
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push eax
push dx
and al, bh
xor dl, al
or dh, dh
xor ah, 0x62
sub eax, 0x3488
and eax, 0x7ee5
dec dh
add eax, eax
pop dx
pop eax
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x401547
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x40155e
push eax
pop eax
ja 0x40155e
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
mov eax, dword [ecx + 0x3c]
add eax, ecx
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
cmp dword [eax], 0x4550
je 0x401581
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jp 0x40159d
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x40159d
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
mov edx, dword [eax + 0x58]
test edx, edx
je 0x4015ad
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, pe_nt_image_headers32
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
jp 0x4015d6
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x4015d6
add dword [ecx + 0x803c79], 0
add byte [edi + 9], dh
cmp dword [ecx + 0x3c], 0x80
ja 0x4015e8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov ecx, dword [ecx + 0x3c]
cmp ecx, 0xc0
jae 0x401612
lea esi, [ecx - 0x80]
push edx
push bx
cmp edx, esi
inc dl
cmp dh, cl
mov edx, 0x5a9c
test dx, bx
test edx, 0x5a77
inc bl
and dh, 0x55
xor bl, dh
pop bx
pop edx
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebp - 4], edx
jne 0x40164c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
xor edi, edi
test esi, esi
jbe 0x40168b
push ebx
test bl, 0x4d
pop ebx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, dword [ebp - 4]
inc edi
cmp edi, esi
mov byte [edi + eax - 1], dl
jb 0x40166a
mov edx, eax
jbe 0x4016a2
push eax
pop eax
ja 0x4016a2
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
mov ecx, esi
mov esi, edx
mov edx, dword [ebp + 8]
mov eax, ecx
shr ecx, 2
lea edi, [edx + 0x80]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
push edx
test bl, 0x3e
sub dh, cl
mov dh, ah
pop edx
pop ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4018f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x41cc44
push 0x406024
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
jne 0x401928
pop ebp
ret
jb 0x40193f
nop
nop
mov edi, edi
xchg dl, dl
jae 0x40193f
adc ebx, dword [ebx + edx*4 + 0x69]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret
Function at 0x4019e0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push esi
jp 0x4019fb
push si
pop si
jnp 0x4019fb
outsd dx, dword [esi]
cmp ah, byte [edx]
aas
pop esp
salc
jbe 0x4019ed
sbb dword [edi + edx*2], 0xffffff85
mov dword [ecx - 0x75], eax
inc ebp
or al, 0x8b
dec ebp
or byte [eax - 1], ch
add dword [edi], ecx
add byte [eax + 0x51], dl
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401a17
pop esi
pop ebp
ret
push edi
jb 0x401a30
push di
pop di
jae 0x401a30
scasb al, byte es:[edi]
bound eax, qword [edx]
pushfd
dec esi
call 0x101879a2
test byte [eax + ebx - 0x7f], 0x4b
lea edx, [esi - 1]
adc eax, sym.imp.ADVAPI32.dll_DeleteService
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, eax
jo 0x401a5c
push cx
mov ch, 0xe0
pop cx
jno 0x401a5c
mov esp, 0x1e26fa6d
invalid
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401a70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
lea eax, [ebp - 4]
push eax
call fcn.00404140
add esp, 4
test eax, eax
jne 0x401ab1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401ad4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
mov edx, dword [ebp - 4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0x40f95c
push 0x40f91c
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jp 0x401c32
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x401c32
or dword [ebx - 0x9ccf383], 0xffffff85
push dword [esi + 0x31]
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jbe 0x401c6c
mov ebx, dword [ebp + 8]
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
mov byte [esi + ebx], dl
inc esi
cmp esi, edi
jb 0x401c3e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401cb0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x82c
xor eax, eax
push ebx
mov dword [esp + 5], eax
push ebp
mov dword [esp + 0xd], eax
push esi
mov dword [esp + 0x15], eax
push edi
xor ebx, ebx
mov word [esp + 0x1d], ax
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x2d]
mov byte [esp + 0x1f], al
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x131]
mov byte [esp + 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x43d]
mov byte [esp + 0x43c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x338]
push 0x104
push ecx
mov byte [esp + 0x18], bl
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edx, [esp + 0x130]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 6
push eax
call fcn.00401c20
add esp, 8
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
lea eax, [esp + 0x234]
push ecx
push edx
push 0x40fb5c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov dword [esp + 0x20], 0x40fc0c
mov dword [esp + 0x24], 0x40fc10
mov dword [esp + 0x28], 0x40fc1c
lea edx, [esp + 0x20]
mov ebp, 3
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x2c]
repne scasb al, byte es:[edi]
mov edi, dword [edx]
add edx, 4
not ecx
dec ecx
mov byte [esp + ecx + 0x2c], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec ebp
rep movsb byte es:[edi], byte [esi]
jne 0x401d97
movsx ecx, byte [esp + 0x338]
lea edx, [esp + 0x130]
push ecx
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x450]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x450]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x40fc34
push 1
mov byte [esp + ecx + 0x454], 0xa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x454]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x454]
push ecx
push eax
lea ecx, [esp + 0x254]
push 0x40fb58
push ecx
call fcn.00401f40
add esp, 0x28
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
jne 0x401e8b
add esp, 0x82c
ret
lea edx, [esp + 0x224]
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, 1
add esp, 0x82c
ret
Function at 0x401f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x401f62
pop edi
pop esi
pop ebx
pop ebp
ret
jbe 0x401f73
xchg ecx, ecx
xchg dl, dl
ja 0x401f73
pop eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push esi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push ebx
push dx
push di
cmp bh, dh
dec di
pop di
pop dx
pop ebx
push esi
call dword [sym.imp.MSVCRT.dll_fflush]
mov eax, dword [ebp + 0x18]
add esp, 4
test eax, eax
je 0x401fb0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x402070
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push ebx
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
cmp dword [ebp - 0x90], 5
jne 0x4020b8
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
cmp dword [ebp - 0x90], 6
jne 0x4020eb
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x4020eb
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 1
push dx
push eax
or ax, 0x4297
and ax, 0x45c0
test esi, eax
test dh, al
cmp dl, 0x51
pop eax
pop dx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4032cb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40330b
xor esi, esi
jmp 0x40330e
mov esi, dword [ebp - 8]
je 0x403326
mov si, si
xchg bx, bx
jne 0x403326
mov al, byte [0x4bb148d3]
outsb dx, byte [esi]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403470
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x41cc74]
push ebx
push esi
push edi
test eax, eax
je 0x40348c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ecx
or bl, ah
sub cl, 0x27
cmp bh, 8
and cx, 0x784f
and bx, 0x94f
pop ecx
pop ebx
push 0x40f894
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edx, eax
test edx, edx
jne 0x4034ba
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
inc al
sub ah, cl
dec eax
cmp cl, cl
cmp ch, dh
test ch, 0
or cx, bx
test ah, 0x35
test ax, 0x637b
pop ecx
pop eax
push 0x40f8a0
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [0x41cc64], eax
jne 0x4034f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test si, di
and ch, dl
and ax, cx
test dl, ah
cmp dh, 0x36
popal
push 0x40f8ac
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
mov dword [ebp - 4], eax
jne 0x403518
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x40f8b8
push eax
call edi
test eax, eax
mov dword [0x41cc6c], eax
jne 0x40354c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jbe 0x403556
push esi
pop esi
ja 0x403556
pop ebx
hlt
push 0x40f8c4
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x40356e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
cmp ax, cx
and ah, dh
cmp ah, 0x3f
add ax, ax
or eax, edx
xor ah, 0x6c
xor ax, bx
pop eax
push 0x40f8d0
push ebx
call edi
test eax, eax
mov dword [0x41cc68], eax
jne 0x40359b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
push 0x40f8e0
push ebx
call edi
test eax, eax
mov dword [0x41cc5c], eax
jne 0x4035bd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
test edx, eax
cmp eax, ecx
pop eax
push 0x40f8f4
push ebx
call edi
test eax, eax
mov dword [0x41cc60], eax
jne 0x4035db
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
push 0x40f908
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [0x41cc70], eax
jne 0x40361d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
or edi, 0x693
or di, 0xd76
or edi, 0x291a
sub di, bx
test di, 0x481d
xor di, 0x7174
and di, di
pop edi
mov eax, 1
Function at 0x403af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor dl, dl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x22b]
mov ebp, 0xfffffdd5
mov byte [ebp - 0x22c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push ecx
push edx
and cx, si
cmp dx, si
xor dl, bh
or dl, 0x67
pop edx
pop ecx
lea edi, [ebp - 0x22c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jle 0x403b8a
mov ax, ax
mov cx, cx
jg 0x403b8a
aaa
jecxz 0x403b06
hlt
mov edi, 0x40f760
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pushal
test cx, ax
inc ax
popal
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x128]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExA]
mov edx, dword [ebp + 8]
push edx
call fcn.00403aa0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x403bf0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jle 0x403bfe
mov si, si
mov si, si
jg 0x403bfe
fsub qword [ebp + 0x458d92c9]
invalid
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403c30
Capabilities:
Get file version info

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
push ebp
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
cmp ebx, esi
je 0x403d14
push edi
push ebx
push 2
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, dword [esp + 0x10]
mov edi, eax
push edi
push ebx
push ecx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea edx, [esp + 0x28]
lea eax, [esp + 0x14]
push edx
push eax
push 0x40fc3c
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
mov dx, word [eax + 0x10]
shr ecx, 0x10
mov word [esp + 0x1a], dx
mov dx, word [eax + 0x14]
mov word [esp + 0x18], cx
mov ecx, dword [eax + 0x14]
mov word [esp + 0x1e], dx
mov eax, dword [esp + 0x1e]
shr ecx, 0x10
mov word [esp + 0x1c], cx
and eax, 0xffff
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
push eax
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x34]
and eax, 0xffff
push edx
push eax
push 0x40fc00
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x404140
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push edi
mov dword [ebp - 0xc], 0x104
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x40417e
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 0x104
jbe 0x40419e
xchg bh, bh
mov ch, ch
xchg cl, cl
ja 0x40419e
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x31c]
push eax
lea edx, [ebp - 4]
push ecx
lea eax, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x4041d1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
xor ax, bx
pop eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
jne 0x4041f1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push ax
push cx
push edi
and al, dl
or ch, 0x3a
dec edi
inc edi
cmp ah, bl
xor ax, ax
cmp cl, dl
dec cl
pop edi
pop cx
pop ax
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404220
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
push esi
push edi
xor edx, edx
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x263]
mov byte [ebp - 0x264], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, 1
cmp eax, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
je 0x404277
mov esi, ebx
push eax
push ebx
push edx
xor bx, si
and dl, 0x7f
dec bh
test bh, 0xd
pop edx
pop ebx
pop eax
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push ebx
lea eax, [ebp - 0x160]
push 0x40f7a4
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x264]
push ebx
push 0x40f7bc
push ecx
call edi
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x160]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov dword [ebp - 0x48], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, 4
dec ecx
mov dword [ebp - 0x34], 0x40f7e4
mov dword [ebp - 0x30], 0x40f7f0
mov dword [ebp - 0x2c], 0x40f7fc
mov dword [ebp - 0x28], 0x40f80c
mov dword [ebp - 0x24], 0x40f814
mov dword [ebp - 0x5c], 2
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
jle 0x40434b
push si
pop si
jg 0x40434b
cmp esi, 5
jae 0x40438b
lea edi, [esi*4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov edx, dword [ebp + edi - 0x48]
mov eax, dword [ebp + edi - 0x20]
mov ecx, dword [ebp + edi - 0x5c]
push edx
mov edx, dword [ebp + edi - 0x34]
push eax
push ecx
lea eax, [ebp - 0x264]
push edx
push eax
push 0x80000002
call esi
test eax, eax
jne 0x404397
add edi, 4
cmp edi, 0x14
jb 0x40435d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048f0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
push edi
push ecx
cmp cl, 0x3f
or ch, dl
cmp cx, cx
or ch, 0x1f
pop ecx
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x404930
pop edi
pop ebp
ret
push edi
or di, 0x74e3
sub di, ax
cmp di, dx
and edi, 0x25ec
and di, 0x51b8
or di, di
pop edi
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
pop edi
pop ebp
ret
Function at 0x10001b00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [edx]
push ebx
push esi
mov esi, ecx
mov ebx, 4
mov cl, byte [edx + 0xd]
mov byte [esi + 0xd], cl
mov cl, byte [edx + 0xe]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
movzx eax, byte [edx + 6]
mov byte [esi + 6], al
movzx eax, byte [edx + 7]
mov byte [esi + 7], al
movzx eax, byte [edx + 8]
mov byte [esi + 8], al
movzx eax, byte [edx + 9]
mov byte [esi + 9], al
movzx eax, byte [edx + 0xa]
mov byte [esi + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [esi + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [esi + 0xc], al
lea eax, [esi + 0xd]
mov byte [esi + 0xe], cl
mov cl, byte [edx + 0xf]
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ch, byte [eax - 1]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov dh, byte [eax + 2]
mov byte [ebp - 4], ch
mov byte [ebp - 3], cl
mov byte [ebp - 1], dl
mov byte [ebp - 2], dh
test bl, 3
jne 0x10001bdd
movzx edx, cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 4]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
mov ecx, ebx
shr ecx, 2
mov ch, byte [ecx + 0x1004ee10]
xor ch, byte [edx + str.cw]
mov dl, byte [ebp - 1]
mov dh, byte [ebp - 2]
mov cl, byte [eax - 0xd]
inc ebx
xor cl, ch
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, byte [ebp - 3]
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, dl
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, dh
mov byte [eax + 6], cl
add eax, 4
cmp ebx, 0x2c
jb 0x10001b80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret